Daniel Roberson
  • Posts
  • About
  • Notes
  • Projects
  • Time
  • Posts
    About
    Notes
    Projects
    Time

Get a host's MAC address on Linux with C

0001-01-01

Linux malware may want to obtain MAC addresses for some reason. Here’s how to do it a few ways in C

using /sys/class/net iterate /sys/class/net’s directories with opendir/readdir/closedir read /sys/class/net/INTERFACE/address with fopen/fscanf/fclose

iterate over each interface and use ioctl SIOCGIFHWADDR

use getifaddrs(3)

popen(“ifconfig |grep HWaddr”)

using netlink/rtnetlink

https://stackoverflow.com/questions/1779715/how-to-get-mac-address-of-your-machine-using-a-c-program


Links to this note

  • Linux Malware - distribution and version enumeration

Recent Posts

Linux Persistence: Modular Software

2025-04-17 DFIR CTF persistence linux persistence apache asterisk

Linux Persistence: Web Shells

2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP

Linux Persistence: Rootkits

2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking

Linux Persistence: Processes

2025-04-11 DFIR persistence processes linux persistence processes

Defanging Linux LKM Rootkits With cleanup_module()

2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit


Home

About

Notes

Projects

Time

© All rights reserved. Powered by Hugo and Erblog.