Bypassing Linux Security – Hiding Linux processes

Stealth Secrets: Security Bypasses and Processes in Linux

Learn about the techniques attackers use to avoid detection and protect their activity. We will also look at the tools and techniques that can be used to detect and counter such threats. Protect your Linux system from hackers and attackers by learning how to bypass security and hide Linux processes. Don’t allow attackers to hide their activity on a Linux system – learn about methods to bypass security and hide Linux processes and keep your system safe.

Bypassing Linux Security – Hiding Linux processes

Prerequisites and requirements

In order to follow the tools used in this document, you must be using one of the following Linux distributions:

• Kali Linux

• Parrot OS

Below is a list of recommended technical prerequisites that you will need to get the most out of this course:

• Introduction to Linux system administration.

• Introduction to Windows.

• Functional knowledge of TCP/IP

• Familiarity with penetration testing concepts and lifecycle.

Note: The methods and tools used in this document were performed on a Kali Linux 2021.2 virtual machine.

Hiding Linux processes with Libprocesshider

GitHub repository: https://github.com/gianlucaborello/libprocesshider

The first step in this process is to clone the Librpocesshider GitHub repository to the target system.

This can be done by running the following command:

git clone https://github.com/gianlucaborello/libprocesshider.git

After cloning the repository, you will need to identify the name of the process you want to hide with Librpocesshider, this can be done by listing the running processes on the system:

In my case, I used grep to avoid searching in the output:

To hide the “shell.py” process from the process tree, we need to go to the librpocesshider directory we just cloned and modify the “processhider.c” file.

This can be done by running the following command:

You will then need to change the “process_to_filter” value to the name of the process you want to hide, as shown in the screenshot below.

In this case, we will hide all occurrences of the “shell.py” process from the process tree.

After making changes, you can save the file.

The next step is to compile the “processhider.c” file into a shardable object file, this can be done by running the following command:

The compilation will create a partitioned object file called “libprocesshider.so” as shown in the following screenshot.

We need to move this shared object file to the /usr/local/lib directory, this can be done by running the following command:

Then we need to load the generic object “libprocesshider.so” and this can be done by running the following command:

We can now confirm that the shell.py process is hidden in the process tree by running the script and listing the running processes.