search for: linspy

Here''s a neat trick for a machine running kerneld: not_root@machine$ /sbin/ifconfig isofs loads ''/lib/modules/(kernel version here)/fs/isofs.o''. /sbin/ifconfig when run as non-root queries a network interface for its configuration. However, if the interface is unknown it also tries to load the module that implements that interface using the name of the interface as

I was wondering if anyone here has or knows how to implement ttysnoop w/ssh ?

As halflife demonstrated in Phrack 50 with his linspy project, it is trivial to patch any system call under Linux from within a module. This means that once your system has been compromised at the root level, it is possible for an intruder to hide completely _without_ modifying any binaries or leaving any visible backdoors behind. Because such tools a...