Linux ubuntu22 5.15.0-133-generic #144-Ubuntu SMP Fri Feb 7 20:47:38 UTC 2025 x86_64
nginx/1.18.0
: 128.199.27.159 | : 216.73.216.1
Cant Read [ /etc/named.conf ]
8.1.31
www-data
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
sbin /
[ HOME SHELL ]
Name
Size
Permission
Action
a2disconf
15.89
KB
-rwxr-xr-x
a2dismod
15.89
KB
-rwxr-xr-x
a2dissite
15.89
KB
-rwxr-xr-x
a2enconf
15.89
KB
-rwxr-xr-x
a2enmod
15.89
KB
-rwxr-xr-x
a2ensite
15.89
KB
-rwxr-xr-x
a2query
9.64
KB
-rwxr-xr-x
aa-remove-unknown
3
KB
-rwxr-xr-x
aa-status
62.62
KB
-rwxr-xr-x
aa-teardown
137
B
-rwxr-xr-x
accessdb
14.55
KB
-rwxr-xr-x
add-shell
1.03
KB
-rwxr-xr-x
addgnupghome
3
KB
-rwxr-xr-x
addgroup
37.35
KB
-rwxr-xr-x
adduser
37.35
KB
-rwxr-xr-x
agetty
55.56
KB
-rwxr-xr-x
apache2
740.89
KB
-rwxr-xr-x
apache2ctl
7.06
KB
-rwxr-xr-x
apachectl
7.06
KB
-rwxr-xr-x
apparmor_parser
1.48
MB
-rwxr-xr-x
apparmor_status
62.62
KB
-rwxr-xr-x
applygnupgdefaults
2.17
KB
-rwxr-xr-x
arp
61.61
KB
-rwxr-xr-x
arpd
26.33
KB
-rwxr-xr-x
arptables
219.04
KB
-rwxr-xr-x
arptables-nft
219.04
KB
-rwxr-xr-x
arptables-nft-restore
219.04
KB
-rwxr-xr-x
arptables-nft-save
219.04
KB
-rwxr-xr-x
arptables-restore
219.04
KB
-rwxr-xr-x
arptables-save
219.04
KB
-rwxr-xr-x
badblocks
34.32
KB
-rwxr-xr-x
bcache-super-show
14.3
KB
-rwxr-xr-x
biosdecode
23.2
KB
-rwxr-xr-x
blkdeactivate
15.97
KB
-rwxr-xr-x
blkdiscard
22.38
KB
-rwxr-xr-x
blkid
50.41
KB
-rwxr-xr-x
blkzone
34.38
KB
-rwxr-xr-x
blockdev
30.38
KB
-rwxr-xr-x
bridge
92.49
KB
-rwxr-xr-x
cache_check
1.33
MB
-rwxr-xr-x
cache_dump
1.33
MB
-rwxr-xr-x
cache_metadata_size
1.33
MB
-rwxr-xr-x
cache_repair
1.33
MB
-rwxr-xr-x
cache_restore
1.33
MB
-rwxr-xr-x
cache_writeback
1.33
MB
-rwxr-xr-x
capsh
30.3
KB
-rwxr-xr-x
cfdisk
94.73
KB
-rwxr-xr-x
cgdisk
150.48
KB
-rwxr-xr-x
chcpu
30.38
KB
-rwxr-xr-x
check_forensic
952
B
-rwxr-xr-x
chgpasswd
58.13
KB
-rwxr-xr-x
chmem
34.38
KB
-rwxr-xr-x
chpasswd
54.16
KB
-rwxr-xr-x
chroot
38.51
KB
-rwxr-xr-x
clamd
202.4
KB
-rwxr-xr-x
clamonacc
178.39
KB
-rwxr-xr-x
cpgr
48.29
KB
-rwxr-xr-x
cppw
48.29
KB
-rwxr-xr-x
cron
50.58
KB
-rwxr-xr-x
cryptdisks_start
1.51
KB
-rwxr-xr-x
cryptdisks_stop
844
B
-rwxr-xr-x
cryptsetup
169.55
KB
-rwxr-xr-x
cryptsetup-reencrypt
90.38
KB
-rwxr-xr-x
cryptsetup-ssh
23.53
KB
-rwxr-xr-x
ctrlaltdel
14.38
KB
-rwxr-xr-x
dbconfig-generate-include
12.36
KB
-rwxr-xr-x
dbconfig-load-include
5.57
KB
-rwxr-xr-x
dcb
80.52
KB
-rwxr-xr-x
debugfs
229.8
KB
-rwxr-xr-x
delgroup
16.11
KB
-rwxr-xr-x
deluser
16.11
KB
-rwxr-xr-x
depmod
166.36
KB
-rwxr-xr-x
devlink
142.86
KB
-rwxr-xr-x
dhclient
442.66
KB
-rwxr-xr-x
dhclient-script
15.92
KB
-rwxr-xr-x
dmeventd
50.38
KB
-rwxr-xr-x
dmidecode
122.98
KB
-rwxr-xr-x
dmsetup
171.01
KB
-rwxr-xr-x
dmstats
171.01
KB
-rwxr-xr-x
dosfsck
82.38
KB
-rwxr-xr-x
dosfslabel
38.38
KB
-rwxr-xr-x
dpkg-preconfigure
3.58
KB
-rwxr-xr-x
dpkg-reconfigure
4.38
KB
-rwxr-xr-x
dumpe2fs
30.31
KB
-rwxr-xr-x
e2freefrag
14.3
KB
-rwxr-xr-x
e2fsck
351.84
KB
-rwxr-xr-x
e2image
42.31
KB
-rwxr-xr-x
e2label
102.55
KB
-rwxr-xr-x
e2mmpstatus
30.31
KB
-rwxr-xr-x
e2scrub
7.13
KB
-rwxr-xr-x
e2scrub_all
5.27
KB
-rwxr-xr-x
e2undo
22.3
KB
-rwxr-xr-x
e4crypt
30.38
KB
-rwxr-xr-x
e4defrag
30.3
KB
-rwxr-xr-x
ebtables
219.04
KB
-rwxr-xr-x
ebtables-nft
219.04
KB
-rwxr-xr-x
ebtables-nft-restore
219.04
KB
-rwxr-xr-x
ebtables-nft-save
219.04
KB
-rwxr-xr-x
ebtables-restore
219.04
KB
-rwxr-xr-x
ebtables-save
219.04
KB
-rwxr-xr-x
era_check
1.33
MB
-rwxr-xr-x
era_dump
1.33
MB
-rwxr-xr-x
era_invalidate
1.33
MB
-rwxr-xr-x
era_restore
1.33
MB
-rwxr-xr-x
ethtool
551.48
KB
-rwxr-xr-x
faillock
14.15
KB
-rwxr-xr-x
fatlabel
38.38
KB
-rwxr-xr-x
fdisk
110.42
KB
-rwxr-xr-x
filefrag
18.32
KB
-rwxr-xr-x
findfs
14.38
KB
-rwxr-xr-x
fixparts
58.48
KB
-rwxr-xr-x
fsadm
23.94
KB
-rwxr-xr-x
fsck
42.42
KB
-rwxr-xr-x
fsck.btrfs
1.16
KB
-rwxr-xr-x
fsck.cramfs
30.44
KB
-rwxr-xr-x
fsck.ext2
351.84
KB
-rwxr-xr-x
fsck.ext3
351.84
KB
-rwxr-xr-x
fsck.ext4
351.84
KB
-rwxr-xr-x
fsck.fat
82.38
KB
-rwxr-xr-x
fsck.minix
54.41
KB
-rwxr-xr-x
fsck.msdos
82.38
KB
-rwxr-xr-x
fsck.vfat
82.38
KB
-rwxr-xr-x
fsck.xfs
1.89
KB
-rwxr-xr-x
fsfreeze
14.38
KB
-rwxr-xr-x
fstab-decode
18.3
KB
-rwxr-xr-x
fstrim
42.38
KB
-rwxr-xr-x
gdisk
174.48
KB
-rwxr-xr-x
genl
90.44
KB
-rwxr-xr-x
getcap
14.3
KB
-rwxr-xr-x
getpcaps
14.3
KB
-rwxr-xr-x
getty
55.56
KB
-rwxr-xr-x
groupadd
66.91
KB
-rwxr-xr-x
groupdel
62.73
KB
-rwxr-xr-x
groupmems
54.19
KB
-rwxr-xr-x
groupmod
66.82
KB
-rwxr-xr-x
grpck
58.13
KB
-rwxr-xr-x
grpconv
50.01
KB
-rwxr-xr-x
grpunconv
50.01
KB
-rwxr-xr-x
grub-bios-setup
941.42
KB
-rwxr-xr-x
grub-install
1.15
MB
-rwxr-xr-x
grub-macbless
929.11
KB
-rwxr-xr-x
grub-mkconfig
8.6
KB
-rwxr-xr-x
grub-mkdevicemap
215.7
KB
-rwxr-xr-x
grub-probe
941.36
KB
-rwxr-xr-x
grub-reboot
4.73
KB
-rwxr-xr-x
grub-set-default
3.47
KB
-rwxr-xr-x
halt
1.06
MB
-rwxr-xr-x
hdparm
139.43
KB
-rwxr-xr-x
httxt2dbm
14.3
KB
-rwxr-xr-x
hwclock
50.5
KB
-rwxr-xr-x
iconvconfig
30.4
KB
-rwxr-xr-x
ifconfig
77.17
KB
-rwxr-xr-x
init
1.76
MB
-rwxr-xr-x
insmod
166.36
KB
-rwxr-xr-x
installkernel
2.6
KB
-rwxr-xr-x
integritysetup
54.07
KB
-rwxr-xr-x
invoke-rc.d
16.12
KB
-rwxr-xr-x
ip
702.05
KB
-rwxr-xr-x
ip6tables
219.04
KB
-rwxr-xr-x
ip6tables-apply
6.89
KB
-rwxr-xr-x
ip6tables-legacy
96.95
KB
-rwxr-xr-x
ip6tables-legacy-restore
96.95
KB
-rwxr-xr-x
ip6tables-legacy-save
96.95
KB
-rwxr-xr-x
ip6tables-nft
219.04
KB
-rwxr-xr-x
ip6tables-nft-restore
219.04
KB
-rwxr-xr-x
ip6tables-nft-save
219.04
KB
-rwxr-xr-x
ip6tables-restore
219.04
KB
-rwxr-xr-x
ip6tables-restore-translate
219.04
KB
-rwxr-xr-x
ip6tables-save
219.04
KB
-rwxr-xr-x
ip6tables-translate
219.04
KB
-rwxr-xr-x
ipmaddr
18.3
KB
-rwxr-xr-x
iptables
219.04
KB
-rwxr-xr-x
iptables-apply
6.89
KB
-rwxr-xr-x
iptables-legacy
96.95
KB
-rwxr-xr-x
iptables-legacy-restore
96.95
KB
-rwxr-xr-x
iptables-legacy-save
96.95
KB
-rwxr-xr-x
iptables-nft
219.04
KB
-rwxr-xr-x
iptables-nft-restore
219.04
KB
-rwxr-xr-x
iptables-nft-save
219.04
KB
-rwxr-xr-x
iptables-restore
219.04
KB
-rwxr-xr-x
iptables-restore-translate
219.04
KB
-rwxr-xr-x
iptables-save
219.04
KB
-rwxr-xr-x
iptables-translate
219.04
KB
-rwxr-xr-x
iptunnel
18.3
KB
-rwxr-xr-x
irqbalance
66.86
KB
-rwxr-xr-x
irqbalance-ui
34.38
KB
-rwxr-xr-x
iscsi-iname
14.3
KB
-rwxr-xr-x
iscsi_discovery
5.17
KB
-rwxr-xr-x
iscsiadm
398.46
KB
-rwxr-xr-x
iscsid
298.55
KB
-rwxr-xr-x
iscsistart
274.56
KB
-rwxr-xr-x
isosize
14.38
KB
-rwxr-xr-x
kbdrate
18.16
KB
-rwxr-xr-x
killall5
30.38
KB
-rwxr-xr-x
kpartx
46.16
KB
-rwxr-xr-x
ldattach
26.38
KB
-rwxr-xr-x
ldconfig
387
B
-rwxr-xr-x
ldconfig.real
1.16
MB
-rwxr-xr-x
locale-gen
4.29
KB
-rwxr-xr-x
logrotate
102.24
KB
-rwxr-xr-x
logsave
14.16
KB
-rwxr-xr-x
losetup
70.52
KB
-rwxr-xr-x
lsmod
166.36
KB
-rwxr-xr-x
luksformat
3.32
KB
-rwxr-xr-x
lvchange
2.89
MB
-rwxr-xr-x
lvconvert
2.89
MB
-rwxr-xr-x
lvcreate
2.89
MB
-rwxr-xr-x
lvdisplay
2.89
MB
-rwxr-xr-x
lvextend
2.89
MB
-rwxr-xr-x
lvm
2.89
MB
-rwxr-xr-x
lvmconfig
2.89
MB
-rwxr-xr-x
lvmdiskscan
2.89
MB
-rwxr-xr-x
lvmdump
10.07
KB
-rwxr-xr-x
lvmpolld
236.34
KB
-rwxr-xr-x
lvmsadc
2.89
MB
-rwxr-xr-x
lvmsar
2.89
MB
-rwxr-xr-x
lvreduce
2.89
MB
-rwxr-xr-x
lvremove
2.89
MB
-rwxr-xr-x
lvrename
2.89
MB
-rwxr-xr-x
lvresize
2.89
MB
-rwxr-xr-x
lvs
2.89
MB
-rwxr-xr-x
lvscan
2.89
MB
-rwxr-xr-x
make-bcache
22.38
KB
-rwxr-xr-x
make-ssl-cert
6.65
KB
-rwxr-xr-x
mdadm
601.31
KB
-rwxr-xr-x
mdmon
258.44
KB
-rwxr-xr-x
mii-tool
26.73
KB
-rwxr-xr-x
mkdosfs
50.83
KB
-rwxr-xr-x
mke2fs
130.62
KB
-rwxr-xr-x
mkfs
14.38
KB
-rwxr-xr-x
mkfs.bfs
22.38
KB
-rwxr-xr-x
mkfs.btrfs
471.25
KB
-rwxr-xr-x
mkfs.cramfs
34.32
KB
-rwxr-xr-x
mkfs.ext2
130.62
KB
-rwxr-xr-x
mkfs.ext3
130.62
KB
-rwxr-xr-x
mkfs.ext4
130.62
KB
-rwxr-xr-x
mkfs.fat
50.83
KB
-rwxr-xr-x
mkfs.minix
42.39
KB
-rwxr-xr-x
mkfs.msdos
50.83
KB
-rwxr-xr-x
mkfs.ntfs
70.38
KB
-rwxr-xr-x
mkfs.vfat
50.83
KB
-rwxr-xr-x
mkfs.xfs
382.77
KB
-rwxr-xr-x
mkhomedir_helper
22.17
KB
-rwxr-xr-x
mkinitramfs
12.16
KB
-rwxr-xr-x
mklost+found
14.3
KB
-rwxr-xr-x
mkntfs
70.38
KB
-rwxr-xr-x
mkswap
46.38
KB
-rwxr-xr-x
modinfo
166.36
KB
-rwxr-xr-x
modprobe
166.36
KB
-rwxr-xr-x
mount.fuse
18.3
KB
-rwxr-xr-x
mount.fuse3
18.3
KB
-rwxr-xr-x
mount.lowntfs-3g
114.98
KB
-rwxr-xr-x
mount.ntfs
159.01
KB
-rwxr-xr-x
mount.ntfs-3g
159.01
KB
-rwxr-xr-x
mpathpersist
31.05
KB
-rwxr-xr-x
multipath
34.15
KB
-rwxr-xr-x
multipathd
134.26
KB
-rwxr-xr-x
mysqld
52.93
MB
-rwxr-xr-x
nameif
14.48
KB
-rwxr-xr-x
needrestart
38.71
KB
-rwxr-xr-x
netplan
798
B
-rwxr-xr-x
newusers
74.73
KB
-rwxr-xr-x
nfnl_osf
18.3
KB
-rwxr-xr-x
nft
26.23
KB
-rwxr-xr-x
nginx
1.18
MB
-rwxr-xr-x
nologin
14.3
KB
-rwxr-xr-x
ntfsclone
50.38
KB
-rwxr-xr-x
ntfscp
34.38
KB
-rwxr-xr-x
ntfslabel
22.38
KB
-rwxr-xr-x
ntfsresize
62.39
KB
-rwxr-xr-x
ntfsundelete
50.38
KB
-rwxr-xr-x
on_ac_power
2.18
KB
-rwxr-xr-x
overlayroot-chroot
2.45
KB
-rwxr-xr-x
ownership
14.45
KB
-rwxr-xr-x
pam-auth-update
20.5
KB
-rwxr-xr-x
pam_extrausers_chkpwd
22.15
KB
-rwxr-sr-x
pam_extrausers_update
30.15
KB
-rwxr-xr-x
pam_getenv
2.82
KB
-rwxr-xr-x
pam_timestamp_check
14.15
KB
-rwxr-xr-x
parted
86.4
KB
-rwxr-xr-x
partprobe
14.38
KB
-rwxr-xr-x
pdata_tools
1.33
MB
-rwxr-xr-x
php-fpm8.1
5.29
MB
-rwxr-xr-x
phpdismod
7.11
KB
-rwxr-xr-x
phpenmod
7.11
KB
-rwxr-xr-x
phpquery
6.24
KB
-rwxr-xr-x
pivot_root
14.38
KB
-rwxr-xr-x
plipconfig
14.3
KB
-rwxr-xr-x
plymouthd
150.55
KB
-rwxr-xr-x
postalias
22.3
KB
-rwxr-xr-x
postcat
22.37
KB
-rwxr-xr-x
postconf
183.8
KB
-rwxr-xr-x
postdrop
22.42
KB
-r-xr-sr-x
postfix
18.38
KB
-rwxr-xr-x
postfix-add-filter
4.84
KB
-rwxr-xr-x
postfix-add-policy
3.77
KB
-rwxr-xr-x
postfix-collate
2.87
KB
-rwxr-xr-x
postkick
14.3
KB
-rwxr-xr-x
postlock
14.3
KB
-rwxr-xr-x
postlog
14.45
KB
-rwxr-xr-x
postmap
22.3
KB
-rwxr-xr-x
postmulti
30.69
KB
-rwxr-xr-x
postqueue
22.38
KB
-r-xr-sr-x
postsuper
30.59
KB
-rwxr-xr-x
posttls-finger
42.38
KB
-rwxr-xr-x
poweroff
1.06
MB
-rwxr-xr-x
pvchange
2.89
MB
-rwxr-xr-x
pvck
2.89
MB
-rwxr-xr-x
pvcreate
2.89
MB
-rwxr-xr-x
pvdisplay
2.89
MB
-rwxr-xr-x
pvmove
2.89
MB
-rwxr-xr-x
pvremove
2.89
MB
-rwxr-xr-x
pvresize
2.89
MB
-rwxr-xr-x
pvs
2.89
MB
-rwxr-xr-x
pvscan
2.89
MB
-rwxr-xr-x
pwck
50.13
KB
-rwxr-xr-x
pwconv
46.01
KB
-rwxr-xr-x
pwunconv
42.01
KB
-rwxr-xr-x
qmqp-sink
18.3
KB
-rwxr-xr-x
qmqp-source
22.31
KB
-rwxr-xr-x
qshape
12.55
KB
-rwxr-xr-x
rarp
32.33
KB
-rwxr-xr-x
readprofile
22.41
KB
-rwxr-xr-x
reboot
1.06
MB
-rwxr-xr-x
remove-shell
1.07
KB
-rwxr-xr-x
resize2fs
66.3
KB
-rwxr-xr-x
rmail
18.3
KB
-rwxr-xr-x
rmmod
166.36
KB
-rwxr-xr-x
rmt
58.57
KB
-rwxr-xr-x
rmt-tar
58.57
KB
-rwxr-xr-x
route
64.27
KB
-rwxr-xr-x
rsyslogd
767.19
KB
-rwxr-xr-x
rtacct
28.31
KB
-rwxr-xr-x
rtcwake
34.38
KB
-rwxr-xr-x
rtmon
90.39
KB
-rwxr-xr-x
runlevel
1.06
MB
-rwxr-xr-x
runuser
54.38
KB
-rwxr-xr-x
sendmail
30.45
KB
-rwxr-xr-x
service
8.88
KB
-rwxr-xr-x
setcap
14.3
KB
-rwxr-xr-x
setvesablank
14.23
KB
-rwxr-xr-x
setvtrgb
14.29
KB
-rwxr-xr-x
sfdisk
102.38
KB
-rwxr-xr-x
sgdisk
162.48
KB
-rwxr-xr-x
shadowconfig
885
B
-rwxr-xr-x
shutdown
1.06
MB
-rwxr-xr-x
slattach
36.08
KB
-rwxr-xr-x
smtp-sink
35.27
KB
-rwxr-xr-x
smtp-source
30.32
KB
-rwxr-xr-x
split-logfile
2.36
KB
-rwxr-xr-x
sshd
899.7
KB
-rwxr-xr-x
start-stop-daemon
47.35
KB
-rwxr-xr-x
sudo_logsrvd
200.1
KB
-rwxr-xr-x
sudo_sendlog
107.34
KB
-rwxr-xr-x
sulogin
42.38
KB
-rwxr-xr-x
swaplabel
18.38
KB
-rwxr-xr-x
swapoff
22.38
KB
-rwxr-xr-x
swapon
42.38
KB
-rwxr-xr-x
switch_root
22.38
KB
-rwxr-xr-x
sysctl
30.23
KB
-rwxr-xr-x
tarcat
936
B
-rwxr-xr-x
tc
614.08
KB
-rwxr-xr-x
telinit
1.06
MB
-rwxr-xr-x
thin_check
1.33
MB
-rwxr-xr-x
thin_delta
1.33
MB
-rwxr-xr-x
thin_dump
1.33
MB
-rwxr-xr-x
thin_ls
1.33
MB
-rwxr-xr-x
thin_metadata_size
1.33
MB
-rwxr-xr-x
thin_repair
1.33
MB
-rwxr-xr-x
thin_restore
1.33
MB
-rwxr-xr-x
thin_rmap
1.33
MB
-rwxr-xr-x
thin_trim
1.33
MB
-rwxr-xr-x
tipc
90.44
KB
-rwxr-xr-x
tune2fs
102.55
KB
-rwxr-xr-x
tzconfig
106
B
-rwxr-xr-x
ufw
4.82
KB
-rwxr-xr-x
unhide
46.56
KB
-rwxr-xr-x
unhide-linux
46.56
KB
-rwxr-xr-x
unhide-posix
14.3
KB
-rwxr-xr-x
unhide-tcp
27.16
KB
-rwxr-xr-x
unhide.rb
13.97
KB
-rwxr-xr-x
unhide_rb
22.4
KB
-rwxr-xr-x
unix_chkpwd
26.15
KB
-rwxr-sr-x
unix_update
30.15
KB
-rwxr-xr-x
update-ca-certificates
5.29
KB
-rwxr-xr-x
update-grub
64
B
-rwxr-xr-x
update-grub-gfxpayload
301
B
-rwxr-xr-x
update-grub2
64
B
-rwxr-xr-x
update-info-dir
1.66
KB
-rwxr-xr-x
update-initramfs
6.74
KB
-rwxr-xr-x
update-locale
2.99
KB
-rwxr-xr-x
update-mime
9.39
KB
-rwxr-xr-x
update-passwd
34.56
KB
-rwxr-xr-x
update-pciids
1.71
KB
-rwxr-xr-x
update-rc.d
16.92
KB
-rwxr-xr-x
update-secureboot-policy
7.43
KB
-rwxr-xr-x
update-shells
3.72
KB
-rwxr-xr-x
upgrade-from-grub-legacy
1.56
KB
-rwxr-xr-x
usb_modeswitch
59.66
KB
-rwxr-xr-x
usb_modeswitch_dispatcher
26.78
KB
-rwxr-xr-x
useradd
127.66
KB
-rwxr-xr-x
userdel
86.85
KB
-rwxr-xr-x
usermod
123.46
KB
-rwxr-xr-x
uuidd
30.85
KB
-rwxr-xr-x
validlocale
1.73
KB
-rwxr-xr-x
vcstime
14.15
KB
-rwxr-xr-x
vdpa
30.56
KB
-rwxr-xr-x
veritysetup
43.76
KB
-rwxr-xr-x
vgcfgbackup
2.89
MB
-rwxr-xr-x
vgcfgrestore
2.89
MB
-rwxr-xr-x
vgchange
2.89
MB
-rwxr-xr-x
vgck
2.89
MB
-rwxr-xr-x
vgconvert
2.89
MB
-rwxr-xr-x
vgcreate
2.89
MB
-rwxr-xr-x
vgdisplay
2.89
MB
-rwxr-xr-x
vgexport
2.89
MB
-rwxr-xr-x
vgextend
2.89
MB
-rwxr-xr-x
vgimport
2.89
MB
-rwxr-xr-x
vgimportclone
2.89
MB
-rwxr-xr-x
vgmerge
2.89
MB
-rwxr-xr-x
vgmknodes
2.89
MB
-rwxr-xr-x
vgreduce
2.89
MB
-rwxr-xr-x
vgremove
2.89
MB
-rwxr-xr-x
vgrename
2.89
MB
-rwxr-xr-x
vgs
2.89
MB
-rwxr-xr-x
vgscan
2.89
MB
-rwxr-xr-x
vgsplit
2.89
MB
-rwxr-xr-x
vigr
56.53
KB
-rwxr-xr-x
vipw
56.53
KB
-rwxr-xr-x
visudo
219.79
KB
-rwxr-xr-x
vpddecode
14.58
KB
-rwxr-xr-x
wipefs
38.38
KB
-rwxr-xr-x
xfs_admin
1.37
KB
-rwxr-xr-x
xfs_bmap
695
B
-rwxr-xr-x
xfs_copy
82.48
KB
-rwxr-xr-x
xfs_db
652.44
KB
-rwxr-xr-x
xfs_estimate
14.16
KB
-rwxr-xr-x
xfs_freeze
800
B
-rwxr-xr-x
xfs_fsr
42.18
KB
-rwxr-xr-x
xfs_growfs
38.28
KB
-rwxr-xr-x
xfs_info
1.26
KB
-rwxr-xr-x
xfs_io
199.55
KB
-rwxr-xr-x
xfs_logprint
78.33
KB
-rwxr-xr-x
xfs_mdrestore
26.17
KB
-rwxr-xr-x
xfs_metadump
782
B
-rwxr-xr-x
xfs_mkfile
1.02
KB
-rwxr-xr-x
xfs_ncheck
685
B
-rwxr-xr-x
xfs_quota
90.16
KB
-rwxr-xr-x
xfs_repair
599.38
KB
-rwxr-xr-x
xfs_rtcp
18.15
KB
-rwxr-xr-x
xfs_scrub
106.27
KB
-rwxr-xr-x
xfs_scrub_all
5.87
KB
-rwxr-xr-x
xfs_spaceman
42.3
KB
-rwxr-xr-x
xtables-legacy-multi
96.95
KB
-rwxr-xr-x
xtables-monitor
219.04
KB
-rwxr-xr-x
xtables-nft-multi
219.04
KB
-rwxr-xr-x
zerofree
14.15
KB
-rwxr-xr-x
zic
62.32
KB
-rwxr-xr-x
zramctl
54.52
KB
-rwxr-xr-x
Delete
Unzip
Zip
${this.title}
Close
Code Editor : unhide.rb
#!/usr/bin/ruby -w # Try to find running processes using different methods, and report # processes found through some means but not through others. # # Exit code 2 means something fishy was detected. # # Exit code 1 means something went wrong. # Copyright 2009 by Johan Walles, johan.walles@gmail.com # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. require 'set' require 'fiddle/import' require 'fiddle/struct' # Support for libc functions not covered by the standard Ruby # libraries module LibC if RUBY_VERSION =~ /^1\.8/ extend Fiddle::Importable else extend Fiddle::Importer end dlload "libc.so.6" # PID scanning functions extern "int getsid(int)" extern "int sched_getscheduler(int)" extern "int sched_getparam(int, void*)" extern "int sched_rr_get_interval(int, void*)" extern "int sched_getaffinity(int, int, void*)" extern "int readlink(char *, char *, int)" extern "int kill(int, int)" # We want to ask sysinfo about the number of active PIDs. This # result struct has been taken from the sysinfo(2) Linux man page. SysInfoData = struct [ "long uptime", "long loads[3]", "long totalram", "long freeram", "long sharedram", "long bufferram", "long totalswap", "long freeswap", "short procs", "long padding[42]" ] extern "int sysinfo(void *)" end # A piece of scratch memory where system calls can fill in # information. What's written here is not interesting, it's just that # some of the PID scanning functions need a memory area to write into. scratch = "\0" * 1024 # Make sure our scratch buffer is large enough for sched_getaffinity() while LibC.sched_getaffinity(0, scratch.length, scratch) == -1 scratch = "\0" * (scratch.length * 2) end $proc_parent_pids = nil $proc_tasks = nil $ps_pids = nil $proc_readdir_pids = nil def setup # List all parent processes pointed out by anybody in /proc $proc_parent_pids = Set.new proc_dir = Dir.new("/proc") proc_dir.each do |proc_entry| next unless File.directory?("/proc/" + proc_entry) next unless proc_entry =~ /^[0-9]+$/ status_file = File.new("/proc/#{proc_entry}/status") begin status_file.each_line do |line| line.chomp! next unless line =~ /^ppid:\s+([0-9]+)$/i ppid = $1.to_i $proc_parent_pids << ppid break end ensure status_file.close end end proc_dir.close # List all thread pids in /proc $proc_tasks = {} proc_dir = Dir.new("/proc") proc_dir.each do |proc_entry| next unless File.directory?("/proc/" + proc_entry) next unless proc_entry =~ /^[0-9]+$/ task_dir = Dir.new("/proc/#{proc_entry}/task") begin task_dir.each do |task_pid| next unless task_pid =~ /^[0-9]+$/ # "true" means we *have* an executable exe = true begin # Store the *name* of the executable exe = File.readlink("/proc/#{proc_entry}/task/#{task_pid}/exe") rescue Errno::EACCES, Errno::ENOENT # This block intentionally left blank end $proc_tasks[task_pid.to_i] = exe end ensure task_dir.close end end proc_dir.close # List all PIDs displayed by ps $ps_pids = {} $ps_pids.default = false ps_stdout = IO.popen("ps axHo lwp,cmd", "r") ps_pid = ps_stdout.pid ps_stdout.each_line do |ps_line| ps_line.chomp! next unless ps_line =~ /^\s*([0-9]+)\s+([^ ]+).*$/ pid = $1.to_i exe = $2 $ps_pids[pid] = exe end ps_stdout.close # Remove the ps process itself from our pid list $ps_pids.delete ps_pid # List all pids found by readdir on /proc $proc_readdir_pids = Set.new Dir.open("/proc").each do |dir| next unless dir =~ /^[0-9]+$/ $proc_readdir_pids << dir.to_i end end # Return errno after last library call def get_errno() return Fiddle.respond_to?("last_error") ? Fiddle::last_error : Fiddle::last_error end # This array contains named PID detectors. Given a PID to examine they # can say: # * true (it exists) # * "some string" (it exists, and here is its name) # * false (it doesn't exist) # * nil (don't know) $pid_detectors = [ ["ps", proc { |pid| # Does "ps" list this pid? $ps_pids[pid] }], ["/proc naive", lambda { |pid| # Is there a /proc entry for this pid? File.directory?("/proc/#{pid}") }], ["/proc readdir", lambda { |pid| # Did we find this pid when listing the contents of /proc? if $proc_readdir_pids.include?(pid) true else nil end }], ["/proc opendir", lambda { |pid| # Is there a /proc entry for this pid that we can do opendir() on? begin Dir.open("/proc/#{pid}") true rescue Errno::ENOENT false end }], ["/proc/<pid>/status", lambda { |pid| # Parse the process name out of /proc/1234/status begin process_name = true File.open("/proc/#{pid}/status").each do |line| next unless line =~ /Name:[\t ]+(.*)$/ process_name = $1 break end process_name rescue Errno::ENOENT false end }], ["/proc readlink", lambda { |pid| # Read the /proc/1234/exe entry for this pid begin File.readlink("/proc/#{pid}/exe") rescue Errno::EACCES "<run unhide.rb as root to identify exe>" rescue Errno::ENOENT # Some kernel processes have unreadable symlinks in /proc/1234/pid, and # we can't tell "unreadable symlink" apart from "process doesn't exist" nil end }], ["/proc libc-readlink", lambda { |pid| # Is this process visible by the readlink libc function? # The result of this can differ from File.readlink() if # somebody has preloaded a library that overrides certain # libc functions as described here: # http://sourceforge.net/mailarchive/message.php?msg_id=28258660 length = LibC.readlink("/proc/#{pid}/exe", scratch, scratch.length) if length >= 0 scratch[0..(length - 1)] else case get_errno() when 2 # ENOENT # Some kernel processes have unreadable symlinks in /proc/1234/pid, and # we can't tell "unreadable symlink" apart from "process doesn't exist" nil when 13 # EACCES "<run unhide.rb as root to identify exe>" else raise "Unknown errno #{errno}" end end }], ["/proc tasks", proc { |pid| # Is there a /proc/1234/tasks/pid directory for # this pid? $proc_tasks[pid] }], ["/proc parent", proc { |pid| # Does any /proc entry point this pid out as a # parent pid? if $proc_parent_pids.include? pid true else nil end }], ["/proc chdir", proc { |pid| # Can we chdir into /proc/<pid>? begin Dir::chdir "/proc/#{pid}" true rescue Errno::ENOENT false end }], ["getsid()", proc { |pid| LibC.getsid(pid) != -1 }], ["getpgid()", proc { |pid| exists = true begin Process.getpgid(pid) rescue exists = false end exists }], ["getpriority()", proc { |pid| exists = true begin Process.getpriority(Process::PRIO_PROCESS, pid) rescue exists = false end exists }], ["sched_getparam()", proc { |pid| LibC.sched_getparam(pid, scratch) != -1 }], ["sched_getaffinity()", proc { |pid| LibC.sched_getaffinity(pid, scratch.length, scratch) != -1 }], ["sched_getscheduler()", proc { |pid| LibC.sched_getscheduler(pid) != -1 }], ["kill(pid, 0)", proc { |pid| if LibC.kill(pid, 0) == 0 true else case get_errno when 1 # EPERM true when 3 # ESRCH false else raise "Unknown errno #{errno}" end end }] ] found_something = false # Scan PIDs and report those found by some means but not others # # Returns a map of pids->warning strings def get_suspicious_pids(pids_to_scan = nil) if pids_to_scan == nil pid_max = File.new("/proc/sys/kernel/pid_max").gets.to_i pids_to_scan = (1..pid_max) end return_me = Hash.new pids_to_scan.each do |pid| pid_exists = {} $pid_detectors.each do |pid_detector| detector_name = pid_detector[0] detector_proc = pid_detector[1] pid_exists[detector_name] = detector_proc.call(pid) end # Is there consensus about the existence of this process? suspicious = false existence_consensus = nil pid_exists.values.each do |existence| # Always over-write "don't know" existence_consensus = existence if existence_consensus == nil # This one is undecisive, skip it next if existence == nil # Does the result of this test match the consensus? if existence_consensus == false unless existence == false suspicious = true break end else # Anything but "false" is considered to be true, can be a string # with a process name in it for example if existence == false suspicious = true break end end end if suspicious # Put output in a string and add it to the return result message = "Suspicious PID #{pid}:" $pid_detectors.each do |detector| detector_name = detector[0] detector_result = pid_exists[detector_name] next if detector_result == nil description = "" description = " (\"#{detector_result}\")" if detector_result.class == String message += sprintf("\n %s: %s%s", detector_result ? " Seen by" : "Invisible to", detector_name, description) end return_me[pid] = message end end return return_me end ## ## Main program starts here ## puts "Scanning for hidden processes..." setup # Check for unknown preloads. This will name the Jynx LD Poisoning # library. suspicious_mappings = Set.new File.open("/proc/self/maps").each do |line| next unless line =~ /[^\/]*(\/.*)$/ mapped_file = $1 next if File::exist? mapped_file suspicious_mappings << mapped_file end unless suspicious_mappings.empty? found_something = true STDERR.puts "I have a mapped file (or more) that I can't access! Results may be wrong." STDERR.puts "Check /etc/ld.so.preload or dynamic linker for compromise:" suspicious_mappings.each do |mapping| STDERR.puts " #{mapping}" end end # Verify PID count between ps and sysinfo() sysinfo = LibC::SysInfoData.malloc if LibC.sysinfo(sysinfo) == -1 STDERR.puts "Error: failed calling sysinfo()" exit 1 end if sysinfo.procs != $ps_pids.size $stderr.puts "ps and sysinfo() process count mismatch:" $stderr.puts " ps: #{$ps_pids.size} processes" $stderr.puts " sysinfo(): #{sysinfo.procs} processes" found_something = true end suspicious_pids = get_suspicious_pids unless suspicious_pids.empty? # Filter out false positives by testing all positives again. False # positives occur when we race with processes starting up or # shutting down. setup still_suspicious_pids = get_suspicious_pids(suspicious_pids.keys) still_suspicious_pids.keys.sort.each do |still_suspicious_pid| warning_text = suspicious_pids[still_suspicious_pid] next unless warning_text found_something = true $stderr.puts warning_text end end if found_something exit 2 else puts "No hidden processes found!" end
Close
