Vulnerability Development mailing list archives

file hiding under Linux


From: "sam_sec () ziplip com" <sam_sec () ziplip com>
Date: Mon, 23 Jun 2003 13:31:56 -0700 (PDT)

Hi,

First off I'd like to apologise for my inaptness but I'm new to hacking,
but I'm also, or so I'm told, very creative (switched from a humanities major to CS) and am
full of new ideas that I'd like to
discuss and get feedback on. Ok so I've been working on filehiding for the
linux operating system (www.linux.org) that you can download for free
and is very popular. But you probably all know this. I was wondering,
would it be possible to abuse the linux enviroment to make legitemit users
think a certain file was not present. Like, you can set the enviroment
variable $PATH to something like "/tmp". In the bourne again shell version
2.05b one can use "export" to set enviroment variables. There might be
other techniques but my Linux course hasn't covered them yet. I'm open for
ideas though. This technique only works for executing binaries, listing
the directory will still find it.

So for hiding the binaries in /usr/bin an example would be:

$ export PATH="/tmp"
$ ls
-bash: ls: command not found
$ echo "hid all files in /usr/bin"
hid all files in /usr/bin
$ whereis echo
-bash: whereis: command not found
$

So basically I'm building on this, I'd love some feedback and maybe how to
implement this technique in other scenarios.

With regards,
Sam


Current thread: