Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to unhide hidden content from between tags? #1

Open
shanginn opened this issue Oct 27, 2017 · 10 comments
Open

How to unhide hidden content from between tags? #1

shanginn opened this issue Oct 27, 2017 · 10 comments

Comments

@shanginn
Copy link
Contributor

Hey, great work! thank you!
But how to unhide content inside tags after it's been inserted?

@shanginn
Copy link
Contributor Author

shanginn commented Oct 27, 2017

and it seems like installer.sh is failing after installing because of that. here is the output

./installer.sh: line 13: KERNEL_VERSION/kernel/drivers/PulseAudio/reptile_mod
PWD=/root/Reptile/

function usage {
	echo -e ne[00: No such file or directory
./installer.sh: line 14: $'31m############################################################################e[00m\n\techo -e e[00': command not found
./installer.sh: line 14: 31m############################: command not found
./installer.sh: line 14: 36mREPTILE: command not found
./installer.sh: line 14: 31m: command not found
writen by: F0rb1dd3n

Usage: ./installer.sh <arg>

	build		Compile the module
	install		Compile and install the module persistently
	remove		Remove the persistence of module

./installer.sh: line 21: syntax error near unexpected token `}'
./installer.sh: line 21: `}

@f0rb1dd3n
Copy link
Owner

f0rb1dd3n commented Oct 28, 2017

Hello, thank you for your words.

Reptile hide contents by hooking syscall read(). So, to unhide, you can overwrite the lines witch contain the tags, and the next time read() is called, the contents won't be hidden. Else, you must to remove the module.

Installer.sh loads the module at the end. So, nothing is hidden until that. What distro are you installing? I will verify this bug.

Greetings,
Ighor

@f0rb1dd3n
Copy link
Owner

@shanginn did you solve this issue? Can I close this?

@shanginn
Copy link
Contributor Author

shanginn commented Nov 2, 2017

hello, sorry for the delay.
installer.sh failing after the install.
my question is: how can I overwrite lines inside the tags if I can't see them?

@shanginn
Copy link
Contributor Author

shanginn commented Nov 2, 2017

btw: you can see these lines using grep :)

@f0rb1dd3n
Copy link
Owner

f0rb1dd3n commented Nov 3, 2017

I haven't getting this error with install.sh, but I would like to test that. After installing, Reptile will act and you may get some errors. I think you must unload the module from kernel to use install.sh again.

About the tags, you can mark the line that you are putting that. Or as you said, you can use grep for that.

By the way, thanks for your pull request. I merged that, but now I took out hacking.h and put that functions for its respective files that will be used.

:)

@f0rb1dd3n
Copy link
Owner

@shanginn can we close this issue?

@shanginn
Copy link
Contributor Author

I didn't quite understood what you meant about "marking" the lines with tags.
but I can't think about any neat solution to this anyway so sure we can close it. thank you for your time :)

@f0rb1dd3n
Copy link
Owner

f0rb1dd3n commented Nov 17, 2017

@shanginn,

I mean, when you are writing the tags in a file, you take a note what line you are writing in. But using grep -n "<reptile" file.txt you will can see this line, if you want to estract the exact lines that starts the tags, you can do:

grep -n "<reptile" file | cut -d ":" -f 1

But now, you haven't to do it anymore. I just wrote a feature to enable and disable "hiding file content feature". All you have to do is:

kill -51 0

That command will enable "hiding file content feature" if is disabled, or disable if is enabled.

I hope you enjoy this.
Please, tell me if I solved your issue.

Cya

@shanginn
Copy link
Contributor Author

yes, it's great feature. but it could potentially disclosure presence of the rootkit.
I know I'm asking too much, but is it possible to temporarily disable hiding for specific process, something like sudo for this feature. for example rdo vim file.txt to be able to edit hidden content of the file.txt without unhiding content of all files?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants