🚀 go-pugleaf

sxjcb@orca.alaska.edu (Jay C. Beavers) writes:
>I've recently heard that you can hide a process from being displayed by a
>ps -ax command.  Is this true, and if so what security implications does it
>have?  How is this done,

#include <stdio.h>
#include <string.h>

int main(argc, argv)
    int argc;
    char **argv;
{
    char *p;

    for (p = argv[0]; *p; p++)
	*p = 0;
    strcpy(argv[0], "rn");

    (void)getchar();  /* to allow you to see that ps reports "rn" */
    return(0);
}

flaps@dgp.toronto.edu (Alan J Rosenthal) writes:

>sxjcb@orca.alaska.edu (Jay C. Beavers) writes:
>>I've recently heard that you can hide a process from being displayed by a
>>ps -ax command.  Is this true, and if so what security implications does it
>>have?  How is this done,

>#include <stdio.h>
>#include <string.h>

>int main(argc, argv)
>    int argc;
>    char **argv;
>{
>    char *p;

>    for (p = argv[0]; *p; p++)
>	*p = 0;
>    strcpy(argv[0], "rn");

>    (void)getchar();  /* to allow you to see that ps reports "rn" */
>    return(0);
>}

Some people reported that "ps" showed "rn ut".

Here, it shows "rn (a.out)".

eg, I commonly have this:

18570 p8   I     0:01 -tcsh (tcsh)

However, if you can get the pid of a process then you can also
get the inode number of it too and if you have a decent OS, it
shouldnt let you delete it while its running (SunOS allows you
to unlink running processes :-/).

Just now I tried the following:

main(argc, argv)
int	argc;
char	*argv[];
{
	char	**s, *t;

	for (s = argv; *s; s++)
		for (t = *s; *t;)
			*t++ = '\0';
	pause();
}

% cc foo.c
% a.out &
% ps
...
19645 q5   S     0:00  (a.out)
...

If you have problems with ps showing the right name, try checking using
top to see if it will tell you the real name of the process.

Darren.

p.s the above code was compiled/tested on a Pyramid 9825 using OSx5.1 and
    SunOS 4.1.2 where the same results occured.

avalon@coombs.anu.edu.au (Darren Reed) writes:
>Some people reported that "ps" showed "rn ut".

I never saw those articles; on what system does it do this??!??!?  That is, if
you zero out the rest of the name as my article said.  This would be extremely
bizarre behaviour and I'm quite sceptical that it exists.

>Here, it shows "rn (a.out)".
>eg, I commonly have this:
>18570 p8   I     0:01 -tcsh (tcsh)

This is not the same situation.  Did my program actually show "rn (a.out)" or
are you extrapolating?  On what OS?  There is a kludge in ps for when the
argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
triggered by having a completely empty name, as you create later.  Neither of
these are methods I suggested because neither of them achieves the desired
results.

>However, if you can get the pid of a process then you can also
>get the inode number of it too

Processes don't have inode numbers.  Files have inode numbers.

>and if you have a decent OS, it shouldnt let you delete it while its running
>(SunOS allows you to unlink running processes :-/).

If you have a decent OS, it shouldn't try to second-guess you to death.  Unix
has always (well for a very, very long time at least) permitted you to unlink
files which are currently being executed, and to kill processes.  Neither of
these is an undesirable feature; the second is essential; if you don't like the
first, just don't invoke it.

>Just now I tried the following:
>	for (s = argv; *s; s++)
>		for (t = *s; *t;)
>			*t++ = '\0';
>	pause();

Yes, as I originally posted, this is not useful.


And to continue the confusion, gay@moebius.loria.fr (Gay Stephane) writes:
>ok, name is changed. but you can have the real name using ps -axc.
>still waiting for *the* solution.

*The* solution to hiding names from ps -ax?  As I posted.  Some other solution?
I guess it depends on to which problem.  If you want to change the name that
ps -axc reports, change the name of the program before executing it.  Using
symlinks may help but this is not an essential component.

>flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>>avalon@coombs.anu.edu.au (Darren Reed) writes:
>>Some people reported that "ps" showed "rn ut".
>
>I never saw those articles; on what system does it do this??!??!?  That is, if
>you zero out the rest of the name as my article said.  This would be extremely
>bizarre behaviour and I'm quite sceptical that it exists.
>
>>Here, it shows "rn (a.out)".
>>eg, I commonly have this:
>>18570 p8   I     0:01 -tcsh (tcsh)
>
>This is not the same situation.  Did my program actually show "rn (a.out)" or
>are you extrapolating?  On what OS?  There is a kludge in ps for when the
>argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
>triggered by having a completely empty name, as you create later.  Neither of
>these are methods I suggested because neither of them achieves the desired
>results.

How about... the minus sign means that it is a login shell.

>>However, if you can get the pid of a process then you can also
>>get the inode number of it too
>
>Processes don't have inode numbers.  Files have inode numbers.

One can still dump an core image of the process and rummage through to
find out who and what was happening.  Still not safe for a hacker.

Well Jay, it looks like we are out of luck (or not! ... depending on
which side of the line you reside ;-)

-- 
Steven A. Geyer <geyer@is.morgan.com> // if (get_standard_disclaimer())
UNIX IS Dept.                        //           USE_IT(); else
Morgan Stanley & Co., Inc.          // it_is_only_my_unforced_opinion();