https://github.com/naworkcaj/betrayed
![[Image: wiN5mDC.png]](https://i.imgur.com/wiN5mDC.png)
I kinda went out on a limb here making this. I personally think it's a neat idea, but I'm not sure this has any appeal.
It definitely has appeal to me when making it. Something like this is harder to detect than say a rootkit with a PAM backdoor.
When you've got a rootkit with a PAM backdoor, you need to hook not only the libpam symbols, but also everything responsible for going "hey! there's another user on this box!"
With this, all I really need to do is hide connections. (and obviously files+processes, but that goes without saying)
Should you care to want to know more, there are insightful comments spread throughout the code. Fills in a lot of details.
thx!
I kinda went out on a limb here making this. I personally think it's a neat idea, but I'm not sure this has any appeal.
It definitely has appeal to me when making it. Something like this is harder to detect than say a rootkit with a PAM backdoor.
When you've got a rootkit with a PAM backdoor, you need to hook not only the libpam symbols, but also everything responsible for going "hey! there's another user on this box!"
With this, all I really need to do is hide connections. (and obviously files+processes, but that goes without saying)
Should you care to want to know more, there are insightful comments spread throughout the code. Fills in a lot of details.
thx!
