← Back Command Hijacking

Invisible Process

Educational Lab Only
This lab simulates process hiding through shell function injection, as observed in real-world cryptominer deployments. Deploying rootkits or process-hiding malware on systems you do not own is a felony. This simulation exists solely to train defenders.

Briefing

A privileged shell function can shadow any command the user types, including system tools like ps. An attacker who gains a shell can define a ps function that calls the real binary but silently pipes the output through grep -v <miner>, removing all lines mentioning the malicious process. The administrator runs ps and sees a clean process list. The miner consumes 98% CPU and they never notice.

Shell functions sit above even PATH in the resolution chain. They win over binary lookups. The only escape is calling the binary by its absolute path.

1. Aliases → 2. Functions → 3. Builtins → 4. $PATH lookup

The attacker defined a ps shell function. It intercepts every call before $PATH is consulted.

MITRE ATT&CK
T1564.001 - Hide Artifacts: Hidden Files and Directories — Adversaries may hide processes and artifacts to evade detection. Shell function hijacking is a userland technique that requires no kernel module and survives many host-based IDS deployments.

Objectives

Check process list
Check CPU with top
Expose the ps wrapper
Use real ps binary
Find hiding mechanism
Kill and clean
Terminal Miner running (hidden)
0 / 6