Compare commits
4 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
80d19ab0d0 | ||
|
|
88feb5bce2 | ||
|
|
92e1864a94 | ||
| bab68d50cf |
5 changed files with 67 additions and 21 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
unhide20080519.tgz
|
||||
21
Makefile
21
Makefile
|
|
@ -1,21 +0,0 @@
|
|||
# Makefile for source rpm: unhide
|
||||
# $Id$
|
||||
NAME := unhide
|
||||
SPECFILE = $(firstword $(wildcard *.spec))
|
||||
|
||||
define find-makefile-common
|
||||
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(find-makefile-common))
|
||||
|
||||
ifeq ($(MAKEFILE_COMMON),)
|
||||
# attept a checkout
|
||||
define checkout-makefile-common
|
||||
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
|
||||
endif
|
||||
|
||||
include $(MAKEFILE_COMMON)
|
||||
1
sources
1
sources
|
|
@ -0,0 +1 @@
|
|||
1194ec0f89c6f28e8eb64fb66836f70f unhide20080519.tgz
|
||||
65
unhide.spec
Normal file
65
unhide.spec
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
Name: unhide
|
||||
Version: 1.0
|
||||
Release: 2%{?dist}.20080519
|
||||
Summary: Tool to find hidden processes and TCP/UDP ports from rootkits
|
||||
|
||||
Group: Applications/System
|
||||
License: GPLv3
|
||||
URL: http://www.security-projects.com/?Unhide
|
||||
Source0: http://www.security-projects.com/unhide20080519.tgz
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||
|
||||
%description
|
||||
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
|
||||
rootkits, Linux kernel modules or by other techniques. It includes two
|
||||
utilities: unhide and unhide-tcp.
|
||||
|
||||
Unhide detects hidden processes using three techniques:
|
||||
|
||||
- comparing the output of /proc and /bin/ps
|
||||
- comparing the information gathered from /bin/ps with the one gathered
|
||||
from system calls (syscall scanning)
|
||||
- full scan of the process ID space (PIDs bruteforcing)
|
||||
|
||||
unhide-tcp identifies TCP/UDP ports that are listening but are not listed
|
||||
in /bin/netstat through brute forcing of all TCP/UDP ports available.
|
||||
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}-20080519
|
||||
|
||||
%build
|
||||
%{__cc} %{optflags} unhide-linux26.c -o unhide
|
||||
%{__cc} %{optflags} unhide-tcp.c -o unhide-tcp
|
||||
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
%{__install} -Dp -m0755 unhide %{buildroot}%{_sbindir}/unhide
|
||||
%{__install} -Dp -m0755 unhide-tcp %{buildroot}%{_sbindir}/unhide-tcp
|
||||
%{__install} -Dp -m0644 man/unhide.8 %{buildroot}%{_mandir}/man8/unhide.8
|
||||
%{__install} -Dp -m0644 man/unhide-tcp.8 %{buildroot}%{_mandir}/man8/unhide-tcp.8
|
||||
|
||||
%clean
|
||||
rm -rf %{buildroot}
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
%doc COPYING LEEME.txt README.txt
|
||||
%doc %{_mandir}/man8/unhide.8*
|
||||
%doc %{_mandir}/man8/unhide-tcp.8*
|
||||
%{_sbindir}/unhide
|
||||
%{_sbindir}/unhide-tcp
|
||||
|
||||
%changelog
|
||||
* Thu Jan 08 2009 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-2
|
||||
- clarified from upstream about license - fixed.
|
||||
|
||||
* Sat Dec 06 2008 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-1
|
||||
- Fixed %%Version and %%Release fields.
|
||||
|
||||
* Fri Nov 07 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-2
|
||||
- Clear %%install, consistency of macro use
|
||||
|
||||
* Tue Nov 04 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-1
|
||||
- Initial package
|
||||
Loading…
Add table
Add a link
Reference in a new issue