forked from Lainports/freebsd-ports
ff0a927b57
rootkits / LKMs or by another hidden technique. It consists of two programs: unhide and unhide-tcp. unhide detects hidden processes through: * Comparison of /proc vs /bin/ps output. * Comparison of info gathered from /bin/ps with info gathered from. * Syscalls (syscall scanning). * Full PIDs space ocupation (PIDs bruteforcing). unhide-tcp identifies TCP/UDP ports that are listening but not listed in /bin/netstat by doing brute forcing of all TCP/UDP ports availables. WWW: http://http://www.security-projects.com/?Unhide/ PR: ports/132131 Submitted by: Nikos Ntarmos <ntarmos@cs.uoi.gr>
30 lines
777 B
Makefile
30 lines
777 B
Makefile
# New ports collection makefile for: unhide
|
|
# Date created: 26 February 2009
|
|
# Whom: ntarmos@cs.uoi.gr
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
|
|
PORTNAME= unhide
|
|
PORTVERSION= 20080519
|
|
CATEGORIES= security
|
|
MASTER_SITES= http://www.security-projects.com/
|
|
DISTNAME= ${PORTNAME}${DISTVERSION}
|
|
EXTRACT_SUFX= .tgz
|
|
|
|
MAINTAINER= ntarmos@cs.uoi.gr
|
|
COMMENT= A forensic tool to find hidden processes and TCP/UDP ports
|
|
|
|
WRKSRC= ${WRKDIR}/${PORTNAME}-${DISTVERSION}
|
|
PLIST_FILES= sbin/unhide sbin/unhide-tcp
|
|
MAN8= unhide.8 unhide-tcp.8
|
|
MANCOMPRESSED= yes
|
|
|
|
.include <bsd.port.pre.mk>
|
|
|
|
pre-configure:
|
|
@${REINPLACE_CMD} -e 's/-eLf/-axH/g' -e 's/$$2/$$1/g' ${WRKSRC}/unhide.c
|
|
@${REINPLACE_CMD} -e 's/-t/-p tcp -/g' -e 's/-u/-p udp -/g' \
|
|
${WRKSRC}/unhide-tcp.c
|
|
|
|
.include <bsd.port.post.mk>
|