File: //sbin/unhide.rb
#!/usr/bin/ruby -w
# Try to find running processes using different methods, and report
# processes found through some means but not through others.
#
# Exit code 2 means something fishy was detected.
#
# Exit code 1 means something went wrong.
# Copyright 2009 by Johan Walles, johan.walles@gmail.com
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
require 'set'
require 'fiddle/import'
require 'fiddle/struct'
# Support for libc functions not covered by the standard Ruby
# libraries
module LibC
if RUBY_VERSION =~ /^1\.8/
extend Fiddle::Importable
else
extend Fiddle::Importer
end
dlload "libc.so.6"
# PID scanning functions
extern "int getsid(int)"
extern "int sched_getscheduler(int)"
extern "int sched_getparam(int, void*)"
extern "int sched_rr_get_interval(int, void*)"
extern "int sched_getaffinity(int, int, void*)"
extern "int readlink(char *, char *, int)"
extern "int kill(int, int)"
# We want to ask sysinfo about the number of active PIDs. This
# result struct has been taken from the sysinfo(2) Linux man page.
SysInfoData = struct [
"long uptime",
"long loads[3]",
"long totalram",
"long freeram",
"long sharedram",
"long bufferram",
"long totalswap",
"long freeswap",
"short procs",
"long padding[42]"
]
extern "int sysinfo(void *)"
end
# A piece of scratch memory where system calls can fill in
# information. What's written here is not interesting, it's just that
# some of the PID scanning functions need a memory area to write into.
scratch = "\0" * 1024
# Make sure our scratch buffer is large enough for sched_getaffinity()
while LibC.sched_getaffinity(0, scratch.length, scratch) == -1
scratch = "\0" * (scratch.length * 2)
end
$proc_parent_pids = nil
$proc_tasks = nil
$ps_pids = nil
$proc_readdir_pids = nil
def setup
# List all parent processes pointed out by anybody in /proc
$proc_parent_pids = Set.new
proc_dir = Dir.new("/proc")
proc_dir.each do |proc_entry|
next unless File.directory?("/proc/" + proc_entry)
next unless proc_entry =~ /^[0-9]+$/
status_file = File.new("/proc/#{proc_entry}/status")
begin
status_file.each_line do |line|
line.chomp!
next unless line =~ /^ppid:\s+([0-9]+)$/i
ppid = $1.to_i
$proc_parent_pids << ppid
break
end
ensure
status_file.close
end
end
proc_dir.close
# List all thread pids in /proc
$proc_tasks = {}
proc_dir = Dir.new("/proc")
proc_dir.each do |proc_entry|
next unless File.directory?("/proc/" + proc_entry)
next unless proc_entry =~ /^[0-9]+$/
task_dir = Dir.new("/proc/#{proc_entry}/task")
begin
task_dir.each do |task_pid|
next unless task_pid =~ /^[0-9]+$/
# "true" means we *have* an executable
exe = true
begin
# Store the *name* of the executable
exe = File.readlink("/proc/#{proc_entry}/task/#{task_pid}/exe")
rescue Errno::EACCES, Errno::ENOENT
# This block intentionally left blank
end
$proc_tasks[task_pid.to_i] = exe
end
ensure
task_dir.close
end
end
proc_dir.close
# List all PIDs displayed by ps
$ps_pids = {}
$ps_pids.default = false
ps_stdout = IO.popen("ps axHo lwp,cmd", "r")
ps_pid = ps_stdout.pid
ps_stdout.each_line do |ps_line|
ps_line.chomp!
next unless ps_line =~ /^\s*([0-9]+)\s+([^ ]+).*$/
pid = $1.to_i
exe = $2
$ps_pids[pid] = exe
end
ps_stdout.close
# Remove the ps process itself from our pid list
$ps_pids.delete ps_pid
# List all pids found by readdir on /proc
$proc_readdir_pids = Set.new
Dir.open("/proc").each do |dir|
next unless dir =~ /^[0-9]+$/
$proc_readdir_pids << dir.to_i
end
end
# Return errno after last library call
def get_errno()
return Fiddle.respond_to?("last_error") ? Fiddle::last_error : Fiddle::last_error
end
# This array contains named PID detectors. Given a PID to examine they
# can say:
# * true (it exists)
# * "some string" (it exists, and here is its name)
# * false (it doesn't exist)
# * nil (don't know)
$pid_detectors = [
["ps", proc { |pid|
# Does "ps" list this pid?
$ps_pids[pid]
}],
["/proc naive", lambda { |pid|
# Is there a /proc entry for this pid?
File.directory?("/proc/#{pid}")
}],
["/proc readdir", lambda { |pid|
# Did we find this pid when listing the contents of /proc?
if $proc_readdir_pids.include?(pid)
true
else
nil
end
}],
["/proc opendir", lambda { |pid|
# Is there a /proc entry for this pid that we can do opendir() on?
begin
Dir.open("/proc/#{pid}")
true
rescue Errno::ENOENT
false
end
}],
["/proc/<pid>/status", lambda { |pid|
# Parse the process name out of /proc/1234/status
begin
process_name = true
File.open("/proc/#{pid}/status").each do |line|
next unless line =~ /Name:[\t ]+(.*)$/
process_name = $1
break
end
process_name
rescue Errno::ENOENT
false
end
}],
["/proc readlink", lambda { |pid|
# Read the /proc/1234/exe entry for this pid
begin
File.readlink("/proc/#{pid}/exe")
rescue Errno::EACCES
"<run unhide.rb as root to identify exe>"
rescue Errno::ENOENT
# Some kernel processes have unreadable symlinks in /proc/1234/pid, and
# we can't tell "unreadable symlink" apart from "process doesn't exist"
nil
end
}],
["/proc libc-readlink", lambda { |pid|
# Is this process visible by the readlink libc function?
# The result of this can differ from File.readlink() if
# somebody has preloaded a library that overrides certain
# libc functions as described here:
# http://sourceforge.net/mailarchive/message.php?msg_id=28258660
length = LibC.readlink("/proc/#{pid}/exe", scratch, scratch.length)
if length >= 0
scratch[0..(length - 1)]
else
case get_errno()
when 2 # ENOENT
# Some kernel processes have unreadable symlinks in /proc/1234/pid, and
# we can't tell "unreadable symlink" apart from "process doesn't exist"
nil
when 13 # EACCES
"<run unhide.rb as root to identify exe>"
else
raise "Unknown errno #{errno}"
end
end
}],
["/proc tasks", proc { |pid|
# Is there a /proc/1234/tasks/pid directory for
# this pid?
$proc_tasks[pid]
}],
["/proc parent", proc { |pid|
# Does any /proc entry point this pid out as a
# parent pid?
if $proc_parent_pids.include? pid
true
else
nil
end
}],
["/proc chdir", proc { |pid|
# Can we chdir into /proc/<pid>?
begin
Dir::chdir "/proc/#{pid}"
true
rescue Errno::ENOENT
false
end
}],
["getsid()", proc { |pid|
LibC.getsid(pid) != -1
}],
["getpgid()", proc { |pid|
exists = true
begin
Process.getpgid(pid)
rescue
exists = false
end
exists
}],
["getpriority()", proc { |pid|
exists = true
begin
Process.getpriority(Process::PRIO_PROCESS, pid)
rescue
exists = false
end
exists
}],
["sched_getparam()", proc { |pid|
LibC.sched_getparam(pid, scratch) != -1
}],
["sched_getaffinity()", proc { |pid|
LibC.sched_getaffinity(pid, scratch.length, scratch) != -1
}],
["sched_getscheduler()", proc { |pid|
LibC.sched_getscheduler(pid) != -1
}],
["kill(pid, 0)", proc { |pid|
if LibC.kill(pid, 0) == 0
true
else
case get_errno
when 1 # EPERM
true
when 3 # ESRCH
false
else
raise "Unknown errno #{errno}"
end
end
}]
]
found_something = false
# Scan PIDs and report those found by some means but not others
#
# Returns a map of pids->warning strings
def get_suspicious_pids(pids_to_scan = nil)
if pids_to_scan == nil
pid_max = File.new("/proc/sys/kernel/pid_max").gets.to_i
pids_to_scan = (1..pid_max)
end
return_me = Hash.new
pids_to_scan.each do |pid|
pid_exists = {}
$pid_detectors.each do |pid_detector|
detector_name = pid_detector[0]
detector_proc = pid_detector[1]
pid_exists[detector_name] = detector_proc.call(pid)
end
# Is there consensus about the existence of this process?
suspicious = false
existence_consensus = nil
pid_exists.values.each do |existence|
# Always over-write "don't know"
existence_consensus = existence if existence_consensus == nil
# This one is undecisive, skip it
next if existence == nil
# Does the result of this test match the consensus?
if existence_consensus == false
unless existence == false
suspicious = true
break
end
else
# Anything but "false" is considered to be true, can be a string
# with a process name in it for example
if existence == false
suspicious = true
break
end
end
end
if suspicious
# Put output in a string and add it to the return result
message = "Suspicious PID #{pid}:"
$pid_detectors.each do |detector|
detector_name = detector[0]
detector_result = pid_exists[detector_name]
next if detector_result == nil
description = ""
description =
" (\"#{detector_result}\")" if detector_result.class == String
message +=
sprintf("\n %s: %s%s",
detector_result ? " Seen by" : "Invisible to",
detector_name,
description)
end
return_me[pid] = message
end
end
return return_me
end
##
## Main program starts here
##
puts "Scanning for hidden processes..."
setup
# Check for unknown preloads. This will name the Jynx LD Poisoning
# library.
suspicious_mappings = Set.new
File.open("/proc/self/maps").each do |line|
next unless line =~ /[^\/]*(\/.*)$/
mapped_file = $1
next if File::exist? mapped_file
suspicious_mappings << mapped_file
end
unless suspicious_mappings.empty?
found_something = true
STDERR.puts "I have a mapped file (or more) that I can't access! Results may be wrong."
STDERR.puts "Check /etc/ld.so.preload or dynamic linker for compromise:"
suspicious_mappings.each do |mapping|
STDERR.puts " #{mapping}"
end
end
# Verify PID count between ps and sysinfo()
sysinfo = LibC::SysInfoData.malloc
if LibC.sysinfo(sysinfo) == -1
STDERR.puts "Error: failed calling sysinfo()"
exit 1
end
if sysinfo.procs != $ps_pids.size
$stderr.puts "ps and sysinfo() process count mismatch:"
$stderr.puts " ps: #{$ps_pids.size} processes"
$stderr.puts " sysinfo(): #{sysinfo.procs} processes"
found_something = true
end
suspicious_pids = get_suspicious_pids
unless suspicious_pids.empty?
# Filter out false positives by testing all positives again. False
# positives occur when we race with processes starting up or
# shutting down.
setup
still_suspicious_pids = get_suspicious_pids(suspicious_pids.keys)
still_suspicious_pids.keys.sort.each do |still_suspicious_pid|
warning_text = suspicious_pids[still_suspicious_pid]
next unless warning_text
found_something = true
$stderr.puts warning_text
end
end
if found_something
exit 2
else
puts "No hidden processes found!"
end