🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #249

Re: Hiding Processes from ps -ax

#249
From: Alan J Rosenthal
Date: Sat, 05 Sep 1992 20:24
47 lines
2255 bytes
fitzgb@mml0.meche.rpi.edu (Brian Fitzgerald) writes:
>If p is char*, then p++ steps p through the characters in argv[0],
>which is not wanted here.

It's what I meant, and I think it is wanted here.  I found that if I just did
strcpy(argv[0], "rn") then ps displayed "rn ut", that is if my binary was named
a.out.  It seems it knows from some other means the length of the argv string
area, and it goes through it just printing spaces for zeroes.

Setting argv[...] to null does nothing, since ps looks at the string area, not
the place where all the pointers are put.  Questions about this can be taken to
comp.lang.c or to e-mail.

To respond to other points:
* This works fine on AIX, at least version 3.1 on the RS6000, which is where I
just tested it.
* Things like "ps -c" will show you the command name, but this can usually be
changed for real via symlinks or copying; they won't show you the arguments.
* It's true that this doesn't prevent it from showing up on ps at all.  But it
can make it awfully innocuous looking.

So here's a program which wipes all arguments, not just the program name.  I
found that on suns (I didn't test this widely), if you set arguments to null
strings, ps tends to get pissed off, so I just set them to spaces.  Ps on the
sun even seems to remove the trailing spaces!  And btw, I had (apparently
mistakenly) assumed that presenting the idea was sufficient and that I didn't
have to present a fully functional program.  But here is a closer to fully
functional program since the first example didn't seem to be sufficient.

#include <stdio.h>
#include <string.h>

int main(argc, argv)
    int argc;
    char **argv;
{
    int i;
    char *p;

    for (i = 0; i < argc; i++)
	for (p = argv[i]; *p; p++)
	    *p = ' ';
    strcpy(argv[0], "rn");

    (void)getchar();
    return(0);
}
Technical Details
Message-ID: <1992Sep5.162409.11890@jarvis.csri.toronto.edu>
Path: arc1-ca.pugleaf.net!sparky!uunet!utcsri!dgp.toronto.edu!flaps
References: <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <3078@ariel.its.unimelb.EDU.AU> <vb1y38-@rpi.edu>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!utcsri!dgp.toronto.edu!flaps
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Hiding Processes from ps -ax
Message-ID: <1992Sep5.162409.11890@jarvis.csri.toronto.edu>
References: <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <3078@ariel.its.unimelb.EDU.AU> <vb1y38-@rpi.edu>
Date: 5 Sep 92 20:24:09 GMT
Lines: 47