Creating a process without listing in ps -aux

Question

I would like to know how the process can be hijacked, means creating a process without listing in ps -aux command.

Comments

Sorry, I can't help you here. But I'm curious - for what use case (except a rootkit) would that feature be helpful?

Answer 1

On Linux I believe all the process management tools use the information
in the /proc filesystem to show process information. You can think of
ps, top, etc as just convenient front-ends to /proc. The "proc"
filesystem is itself just a view into the kernel process table and other
kernel tables. Given this, you would have to hack the kernel code to
create an "invisible" process.

Answer 2

You could name your process something that looks like a common process, like /bin/dash, looks like /bin/bash. Mixed in lots of process it becomes hard to see just one different letter.

Answer 3

On Linux I believe all the process management tools use the information
in the /proc filesystem to show process information. You can think of
ps, top, etc as just convenient front-ends to /proc. The "proc"
filesystem is itself just a view into the kernel process table and other
kernel tables. Given this, you would have to hack the kernel code to
create an "invisible" process.

Answer 4

Essentially, you'll need to modify the kernel. The 'usual' way is to
load a module which modifies how the kernel populates /proc/pid such
that when things (top, ps etc.) read that data they don't get the
entry relating to your hidden process.