Compare commits

...
Sign in to create a new pull request.

4 commits

Author SHA1 Message Date
Fedora Release Engineering
80d19ab0d0 dist-git conversion 2010-07-29 14:42:27 +00:00
Bill Nottingham
88feb5bce2 Fix typo that causes a failure to update the common directory. (releng
#2781)
2009-11-26 01:14:30 +00:00
Rakesh Pandit
92e1864a94 initial import 2009-01-08 05:39:53 +00:00
bab68d50cf Initialize branch F-9 for unhide 2008-12-14 05:25:05 +00:00
5 changed files with 67 additions and 21 deletions

View file

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
unhide20080519.tgz

View file

@ -1,21 +0,0 @@
# Makefile for source rpm: unhide
# $Id$
NAME := unhide
SPECFILE = $(firstword $(wildcard *.spec))
define find-makefile-common
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
endef
MAKEFILE_COMMON := $(shell $(find-makefile-common))
ifeq ($(MAKEFILE_COMMON),)
# attept a checkout
define checkout-makefile-common
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
endef
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
endif
include $(MAKEFILE_COMMON)

View file

@ -0,0 +1 @@
1194ec0f89c6f28e8eb64fb66836f70f unhide20080519.tgz

65
unhide.spec Normal file
View file

@ -0,0 +1,65 @@
Name: unhide
Version: 1.0
Release: 2%{?dist}.20080519
Summary: Tool to find hidden processes and TCP/UDP ports from rootkits
Group: Applications/System
License: GPLv3
URL: http://www.security-projects.com/?Unhide
Source0: http://www.security-projects.com/unhide20080519.tgz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
%description
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
rootkits, Linux kernel modules or by other techniques. It includes two
utilities: unhide and unhide-tcp.
Unhide detects hidden processes using three techniques:
- comparing the output of /proc and /bin/ps
- comparing the information gathered from /bin/ps with the one gathered
from system calls (syscall scanning)
- full scan of the process ID space (PIDs bruteforcing)
unhide-tcp identifies TCP/UDP ports that are listening but are not listed
in /bin/netstat through brute forcing of all TCP/UDP ports available.
%prep
%setup -q -n %{name}-20080519
%build
%{__cc} %{optflags} unhide-linux26.c -o unhide
%{__cc} %{optflags} unhide-tcp.c -o unhide-tcp
%install
rm -rf %{buildroot}
%{__install} -Dp -m0755 unhide %{buildroot}%{_sbindir}/unhide
%{__install} -Dp -m0755 unhide-tcp %{buildroot}%{_sbindir}/unhide-tcp
%{__install} -Dp -m0644 man/unhide.8 %{buildroot}%{_mandir}/man8/unhide.8
%{__install} -Dp -m0644 man/unhide-tcp.8 %{buildroot}%{_mandir}/man8/unhide-tcp.8
%clean
rm -rf %{buildroot}
%files
%defattr(-,root,root,-)
%doc COPYING LEEME.txt README.txt
%doc %{_mandir}/man8/unhide.8*
%doc %{_mandir}/man8/unhide-tcp.8*
%{_sbindir}/unhide
%{_sbindir}/unhide-tcp
%changelog
* Thu Jan 08 2009 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-2
- clarified from upstream about license - fixed.
* Sat Dec 06 2008 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-1
- Fixed %%Version and %%Release fields.
* Fri Nov 07 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-2
- Clear %%install, consistency of macro use
* Tue Nov 04 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-1
- Initial package