There are a lot of tools that can be used to check the hidden process and port; the tools are rootkits, lkms, unhide etc. In this tutorial a tool name as UNHIDE will be used for this purpose.
Unhide is basically used to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique. This tools works under both Linux / Unix, and MS-Windows operating systems.

It detects hidden processes by using three techniques:

  • The proc technique consists of comparing /proc with the output of /bin/ps.
    The sys technique consists of comparing information gathered from /bin/ps with information gathered from system calls.
  • The brute technique consists of bruteforcing the all process IDs. This technique is only available on Linux 2.6 kernels.
  • Most rootkits use the power of the kernel to hide themselves, they are only visible from within the kernel. You can use unhide or tool such as rkhunter to scan for rootkits, backdoors and possible local exploits.
Install UNHIDE

If you are using ubuntu / debian linux you can enter this command below:

#apt-get install unhide

If you are using FreeBSD / unix you can install it using this command below :

#cd /usr/ports/security/unhide
#make install clean

How to use UNHIDE

unhide-tcp is a tool that identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

You can use it as follows:

# unhide-posix proc
# unhide-posix sys
OR
# unhide-linux26 proc
# unhide-linux26 sys
# unhide-linux26 brute

Sample outputs:
Unhide 20100201
http://www.security-projects.com/?Unhide
[*]Searching for Hidden processes through kill(..,0) scanning
[*]Searching for Hidden processes through  comparison of results of system calls
[*]Searching for Hidden processes through getpriority() scanning
[*]Searching for Hidden processes through getpgid() scanning
[*]Searching for Hidden processes through getsid() scanning
[*]Searching for Hidden processes through sched_getaffinity() scanning
[*]Searching for Hidden processes through sched_getparam() scanning
[*]Searching for Hidden processes through sched_getscheduler() scanning
[*]Searching for Hidden processes through sched_rr_get_interval() scanning
[*]Searching for Hidden processes through sysinfo() scanning
HIDDEN Processes Found: 1

If you found something interesting:

# unhide-tcp

Sample outputs:

Unhide 20100201
http://www.security-projects.com/?Unhide
Starting TCP checking
Found Hidden port that not appears in netstat: 1048
Found Hidden port that not appears in netstat: 1049
Found Hidden port that not appears in netstat: 1050
Starting UDP checking

The netstat -tulpn or ss commands displayed nothing about the hidden TCP ports # 1048, 1049, and 1050:

# netstat -tulpn | grep 1048
# ss -lp
# ss -l | grep 1048