0

Here is the scenario: I do not have any prior services or programs, tripwire, etc., on my computer to tell me files or services that have changed. The integrity of a service, say ps, was changed so that it would actually execute the netcat command. I’ll explain it in another way. Say netcat was on my system but it was changed so that when you input ps, it would execute netcat. It completely removed the actual psservice and replaced it with netcat, but it is still called/executed with ps. Now the question is this: How would I find out that netcat is now called by ps?

  • Did you check if it is an alias case? Type alias on your terminal and check the output – BANJOSA Dec 20 '17 at 8:32
  • @BANJOSA well this is a scenario, this is more of a “if it happened” type of thing. And in it, they did not use an alias. – StrangeRanger Dec 20 '17 at 19:00
  • But are you having this issue or not? – BANJOSA Dec 21 '17 at 8:07
  • Not at the moment. – StrangeRanger Dec 21 '17 at 8:09
  • You know that the goal here is to help people with real problems that could be debugged. In your case you can't supply any debugging information since it's not a real problem. You are just wasting time of people that could be trying to help other with real problems. – BANJOSA Dec 21 '17 at 8:15
1

Try using the tool

command -v ps

or

type ps

they will tell you the absolute path and if it is a builtin shell function or alias.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.