Comments (10)
carloslack
commented on August 19, 2024
The proc interface is hidden by default, when you insmod.
Unhide it with kill
from kovid.
homelanmder
commented on August 19, 2024
very thx.and i have another question,how can i hide tcp connection?i can understand the gif ,maybe i need to edit the source code?
from kovid.
carloslack
commented on August 19, 2024
Backdoors included in kv have their traffic hidden along the processes, no need to change the code for that, but you can create a PR for it or something else
from kovid.
homelanmder
commented on August 19, 2024
i hide a process,but network connection is still unhide
[root@amazon ~]# netstat -anptl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 6735/rpcbind
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 7181/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 7138/master
tcp 0 0 192.168.7.144:22 192.168.7.1:53479 ESTABLISHED 24243/sshd: root@pt
tcp 0 36 192.168.7.144:22 192.168.7.1:52758 ESTABLISHED 21713/sshd: root@pt
tcp 0 0 192.168.7.144:8888 192.168.7.1:54475 ESTABLISHED 26267/nc
tcp6 0 0 :::111 :::* LISTEN 6735/rpcbind
tcp6 0 0 :::22 :::* LISTEN 7181/sshd
[root@amazon ~]# echo 26267 > /proc/netinfo
[root@amazon ~]# netstat -anptl
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 6735/rpcbind
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 7181/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 7138/master
tcp 0 0 192.168.7.144:22 192.168.7.1:53479 ESTABLISHED 24243/sshd: root@pt
tcp 0 36 192.168.7.144:22 192.168.7.1:52758 ESTABLISHED 21713/sshd: root@pt
tcp 0 0 192.168.7.144:8888 192.168.7.1:54475 ESTABLISHED -
tcp6 0 0 :::111 :::* LISTEN 6735/rpcbind
tcp6 0 0 :::22 :::* LISTEN 7181/sshd
i really want to create pr,but i can't code with c
from kovid.
carloslack
commented on August 19, 2024
Currently if you use bdclient.sh you'll have connections hidden, without having to change anything. If, for instance, you run, let's say nc and then use kv to hide it, you'll have the process hidden, like any other task, this way they are assumed as non-networking tasks.
from kovid.
homelanmder
commented on August 19, 2024
i understand,thx very much
from kovid.
carloslack
commented on August 19, 2024
No worries, I may soon change code to consider certain processes networking type
from kovid.
homelanmder
commented on August 19, 2024
i'm really expected，bro
from kovid.
carloslack
commented on August 19, 2024
@homelanmder have a look #90 test it if works for you
from kovid.
carloslack
commented on August 19, 2024
Closed by af60d88
from kovid.
Related Issues (17)
- tty sniffer issue on kernels > 5.10
- openssl backdoor issue HOT 1
- Can´t get the rootkit to work! HOT 5
- Does it supports tcp/udp connection? HOT 2
- ERROR: modpost: "do_exit" [/home/aaa/KoviD/kovid.ko] undefined! HOT 3
- Loop loading kernel module is too obvious HOT 9
- [regression] hide/unhide module conflicts sysfs parameters HOT 2
- Write test suite
- fedora 6.0.7 issue with kv_sock_start_fw_bypass HOT 1
- Crash with ubuntu20.04 on active task HOT 16
- Port kv to Ubuntu 20.04.6 LTS, kernel 5.4.0-164-generic #181-Ubuntu SM HOT 19
- Process unhide issue
- Linux 6.1.x kernel mm_struct changes, no struct vm_area_struct *mmap causes compilation failure HOT 2
- Help with startup. HOT 38
- could not insert module kovid.ko: Bad address HOT 9
- No password required for association, lack of security HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kovid.