Comments on: /proc le coffre aux trésors http://lugm.org/2009/06/25/proc-le-coffre-aux-tresors/ Promoting open source software in our beautiful island Fri, 12 Mar 2010 05:52:23 +0400 http://wordpress.org/?v=2.8 hourly 1 By: selven http://lugm.org/2009/06/25/proc-le-coffre-aux-tresors/comment-page-1/#comment-32 selven Sun, 28 Jun 2009 09:26:00 +0000 http://lugm.org/?p=148#comment-32 nie article dd. :D Nice tips ajay :D nie article dd.

:D Nice tips ajay :D

]]> By: ajayramjatan http://lugm.org/2009/06/25/proc-le-coffre-aux-tresors/comment-page-1/#comment-29 ajayramjatan Fri, 26 Jun 2009 19:18:14 +0000 http://lugm.org/?p=148#comment-29 Playing with /proc 1. "ps axh | wc -l" should match "ls -d /proc/[0-9]* | wc -l" This is one of the techniques used to find hidden processes that are deliberately hidden by a compromised "ps" binary. 2. "zcat /proc/config.gz" The current configuration of your running kernel in the format /usr/src/linux/.config. This is saved in your running kernel and automatically generated at /proc mount time if your kernel is compiled with CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC 3. Mounting /proc at other mount points is easy with "mount -t proc none /foo/bar" 4. Quick ICMP echo ignore from ALL echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all Most network magic happens by tuning parameters in /proc/sys/net/ipv4/ Happy exploring and don't break your system :-) Playing with /proc

1. “ps axh | wc -l” should match “ls -d /proc/[0-9]* | wc -l”
This is one of the techniques used to find hidden processes that are deliberately hidden by a compromised “ps” binary.

2. “zcat /proc/config.gz”
The current configuration of your running kernel in the format /usr/src/linux/.config. This is saved in your running kernel and automatically generated at /proc mount time if your kernel is compiled with CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC

3. Mounting /proc at other mount points is easy with “mount -t proc none /foo/bar”

4. Quick ICMP echo ignore from ALL
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

Most network magic happens by tuning parameters in /proc/sys/net/ipv4/

Happy exploring and don’t break your system :-)

]]>