Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[+] Add change which allows for Input of values(file/dir names & usernames) (3.4_hiding_directories and for hiding_logged_in_users) #17

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Conversation

loneicewolf
Copy link

Howdy!

First things to say:
I have long found this repo (and other stuff, the blog, etc) that you made quite helpful. You have my total respect and thanks!

With that out of the way, I wanted a way to make it easier to "input" the values, e.g when hiding a file or a directory, I thought of having a feature where you could just input it when loading it.

Same with the set_root, I wanted to hide any user, not just the root user.

So I tried my best in doing this contribution which (hopefully) is okay.
I did some changes in README files (to reflect what the changes did, and including an example of the change).

If there is any problems, or concerns / comments - please point them out!

Other than that, I do not have very much else to add.

Have a great day!

Over n out //William.

the original, only hides "root". Of course, this can be changed from  "root" to "alice" (if the user is alice, for example to **hide the user alice**). But, I wanted to make it a bit more flexible, or a bit more easy to use when compiled. So I add a input feature, where you can at the time of the LKM Insert; specify and pass a username (like, for example "alice"). I got inspiration from [EXEC-LKM](https://github.com/loneicewolf/EXEC_LKM/blob/main/LKM/lkm_exec.c)
[+] Adding reference 'EXEC-LKM' link to the References/Further Reading
Update README.md to match rootkit.c's changes to allow username input
the original, only hides "boogaloo" files or directories.
this can be changed of course but; the short version is I added 2 lines to allow for inputting the `value` of `prefix` at the time of `inserting the lkm`
It was meant to only be in the description of the pull, not the actual repo. Not sure why I put it there.
@loneicewolf
Copy link
Author

loneicewolf commented Jan 27, 2023

UPDATE 1:

I accidentally added a link to EXEC-LKM repo in the 3_Rootkit Technique's README file - which I intended only to be in the description of (this) pull request. Not in a actual readme file.

It's fixed now. 👍🏻

@loneicewolf loneicewolf changed the title [+] Add change which allows for Input of values (file/dir-name for hiding and username for set_root) [+] Add change which allows for Input of values(file/dir names & usernames) (3.4_hiding_directories and for hiding_logged_in_users) Jan 27, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant