KSTAT(1)

NAME
kstat - Get information directly from kernel structures

SYNOPSIS
kstat [-i iff] [-P] [-p pid] [-M] [-m addr] [-s 0|1] [-S] [-n] [-r] [-T]

DESCRIPTION
kstat displays information taken directly from kernel structures. This is achieved by accessing the /dev/kmem file, so usually root or kmem privilege is required. This is especially useful when we can't trust output from usual sources and applications like, say, after an anauthorized access to our systems. Way before the /proc we counted on kmem to gather infos about the running system. By peeking in kernel memory, we can reach every bit of information about our host and its processes. Today it can still prove effective if we don't know if our ps(1) has been troyanized or our getdents system call has been hijacked or patched. While it could still be possible for attackers to modify kmem on the fly, the naive /proc gives BOTH sysadmins and crackers an advantage. So, the idea and concept behind kstat(1) is to aid legit root in checking critical areas like processes, NICs, LKMs and system calls.

OPTIONS

[-i]
    iff may be specified as a name (e.g. eth0). With this option we can dump infos about the queried interface[s], and can have a better look at the promisc flag.

[-P]
    With this option we can display every running process. Like ps(1) does, we get usual uid and gid information as well the state of the task.

[-p]
    pid is the process id of the task we want to query. This dumps infos about the running process, queries its capabilities and descriptors as well.

[-M]
    This dumps the linked list of loadable modules linked in the kernel. Before traversing it, we load a simple, do-nothing, lkm to get the first memory address. At the end of the dump, the module is removed. Then we scan a portion of kernel memory in search of stealth LKMs and then we attempt to make a stealth module removable again.

[-m]
    addr is the hex address (in the 0x form) of the module to be queried. This is showed with its name, size, flags and first symbol registered in its structure. [Please note that stealth modules usually do NOT register any new symbol to be exported].

[-s]
    With this flag and argument 0, we check all the addresses in memory of the kernel system calls. If the probed address is different from the legit one, a warning message is issued. With argument 1, kstat can restore the legal sys_calls' addresses.

[-S]
    With this flag we verify the first bytes of the system calls. So we can find if a sys_call has been modified, even if its address is unchanged.

[-n]
    Some functions may have been modified, which are associated with TCP/IP protocol. With this flag we can check if these functions have been hijacked.

[-r]
    Even /proc file and inode operations may be tampered. We can check these, too, along with functions associated with the relevant files in /proc/net.

[-T]
    Check and dump network sockets, both AF_INET and AF_INET6. Related processes are shown along with Pids and file descriptors.

FILES
/dev/kmem - kernel memory

SEE ALSO
KSEC(1) BSD version

AUTHOR
FuSyS <fusys@s0ftpj.org> [S0ftPj|BFi]