没有任何数据可供显示
开源项目社区 | 当前位置 : |
|
www.trustie.net/open_source_projects | 主页 > 开源项目社区 > mrcellophane |
mrcellophane
|
0 | 0 | 2 |
贡献者 | 讨论 | 代码提交 |
For a more detailed description of the idea behind this project:
http://www.excitingbits.net/2005/10/23/a-unix-userkit/
It's easy to hide in a system when you have root privileges: the current arms race is bringing Unix rootkit developers deeper and deeper underground: now your OS might even be running inside a malicious virtual machine!
Far from the tumultuous battles of this world, mrcellophane does not care about exploiting root access: he wants to run code in a user session, without the user's knowledge.
This is essentially what Windows trojan horses do.
Functionally mrcellophane is a proof of concept with 4 distinct parts:
- Bootstraping: installation and initial injection
- Active payload: whatever useful we wanted to remotely execute in the first place.
- Hiding: the code necessary to hide mrcellophane's presence from within the session it hijacks
- Replication: the code necessary to propagate mrcellophane's behaviour to new processes