rootkit的檢測工具使用介紹(chkrootkit和rootkit hunter)

用了兩個工具,一個chkrootkit,另外一個rootkit huntur。在使用了這兩個產(chǎn)品后,覺得rootkit的信息更加詳細(xì)一些?,F(xiàn)在就對兩個工具的操作和使用寫一個記錄,也方便之后自己查看。
1. chkrootkit的使用
project: http://www.chkrootkit.org
download: ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
1.1 解壓安裝
#tar -zxvf chkrootkit.tar.gz
#make sense
1.2 運行監(jiān)測
#./chkrootkit
運行結(jié)果在
http://blogimg.chinaunix.net/blog/upfile2/090326111017.pdf
判斷有問題的信息如下:
Checking `ifconfig'... INFECTED
Checking `ls'... INFECTED
Checking `netstat'... INFECTED
Checking `ps'... INFECTED
Checking `top'... INFECTED
Searching for Madalin rootkit default files... Possible Madalin rootkit installed
Checking `bindshell'... INFECTED (PORTS: 145)
Checking `lkm'... You have 77 process hidden for readdir command
You have 77 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
Checking `sniffer'... eth0: PROMISC
不幸中招,系統(tǒng)只能夠重新安裝了。在看了這個文檔之后,對chkrootkit這個工具又看了一些其他資料??梢宰鰎ootkit的自動檢查操作
具體可以看 http://www.centospub.com/make/chkrootkit.html
1.3 chkrootkit參數(shù)說明
Usage: ./chkrootkit [options] [test ...]
Options:
-h 顯示幫助信息
-V 顯示版本信息
-l 顯示測試內(nèi)容
-d debug模式,顯示檢測過程的相關(guān)指令程序
-q 安靜模式,只顯示有問題部分,
-x 高級模式,顯示所有檢測結(jié)果
-r dir 設(shè)定指定的目錄為根目錄
-p dir1:dir2:dirN 檢測指定目錄
-n 跳過NFS連接的目錄
2. rootkit hunter的使用
Project: http://www.rootkit.nl/projects/rootkit_hunter.html
download: http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.4.tar.gz?use_mirror=jaist
2.1 解壓安裝
解壓
#tar -zxvf rkhunter-1.3.4.tar.gz
安裝
#cd rkhunter-1.3.4
#./installer.sh -h
Usage: ./installer.sh <parameters>
Ordered valid parameters:
--help (-h) : 顯示幫助
--examples : 顯示安裝實例
--layout <value> : 選擇安裝模板(安裝必選參數(shù)).
模板選擇:
- default: (FHS compliant),
- /usr,
- /usr/local,
- oldschool: 之前版本安裝路徑,
- custom: 自定義安裝路徑,
- RPM: for building RPM's. Requires $RPM_BUILD_ROOT.
- DEB: for building DEB's. Requires $DEB_BUILD_ROOT.
--striproot : Strip path from custom layout (for package maintainers).
--install : 根據(jù)選擇目錄安裝
--show : 顯示安裝路徑
--remove : 卸載rkhunter
--version : 顯示安裝版本
我使用的安裝指令
#./installer.sh --layout default --install
2.2 rkhunter操作
#/usr/local/bin/rkhunter --propupd
#/usr/local/bin/rkhunter -c --sk --rwo
Warning: File '/bin/awk' has the immutable-bit set.
Warning: File '/bin/basename' has the immutable-bit set.
Warning: File '/bin/bash' has the immutable-bit set.
Warning: File '/bin/cat' has the immutable-bit set.
Warning: File '/bin/chmod' has the immutable-bit set.
Warning: File '/bin/chown' has the immutable-bit set.
Warning: File '/bin/cp' has the immutable-bit set.
Warning: File '/bin/csh' has the immutable-bit set.
Warning: File '/bin/cut' has the immutable-bit set.
Warning: File '/bin/date' has the immutable-bit set.
Warning: File '/bin/df' has the immutable-bit set.
Warning: File '/bin/dmesg' has the immutable-bit set.
Warning: File '/bin/echo' has the immutable-bit set.
Warning: File '/bin/ed' has the immutable-bit set.
Warning: File '/bin/egrep' has the immutable-bit set.
Warning: File '/bin/env' has the immutable-bit set.
Warning: File '/bin/fgrep' has the immutable-bit set.
Warning: File '/bin/grep' has the immutable-bit set.
Warning: File '/bin/kill' has the immutable-bit set.
Warning: File '/bin/login' has the immutable-bit set.
Warning: File '/bin/ls' has the immutable-bit set.
Warning: File '/bin/mail' has the immutable-bit set.
Warning: File '/bin/mktemp' has the immutable-bit set.
Warning: File '/bin/more' has the immutable-bit set.
Warning: File '/bin/mount' has the immutable-bit set.
Warning: File '/bin/mv' has the immutable-bit set.
Warning: File '/bin/netstat' has the immutable-bit set.
Warning: File '/bin/ps' has the immutable-bit set.
Warning: File '/bin/pwd' has the immutable-bit set.
Warning: File '/bin/rpm' has the immutable-bit set.
Warning: File '/bin/sed' has the immutable-bit set.
Warning: File '/bin/sh' has the immutable-bit set.
Warning: File '/bin/sort' has the immutable-bit set.
Warning: File '/bin/su' has the immutable-bit set.
Warning: File '/bin/touch' has the immutable-bit set.
Warning: File '/bin/uname' has the immutable-bit set.
Warning: File '/bin/gawk' has the immutable-bit set.
Warning: File '/bin/tcsh' has the immutable-bit set.
Warning: File '/usr/bin/awk' has the immutable-bit set.
Warning: File '/usr/bin/cut' has the immutable-bit set.
Warning: File '/usr/bin/env' has the immutable-bit set.
Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: perl script text executable
Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable
Warning: File '/usr/bin/kill' has the immutable-bit set.
Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne shell script text executable
Warning: File '/usr/bin/top' has the immutable-bit set.
Warning: The command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable
Warning: File '/usr/bin/gawk' has the immutable-bit set.
Warning: File '/sbin/chkconfig' has the immutable-bit set.
Warning: File '/sbin/depmod' has the immutable-bit set.
Warning: File '/sbin/fuser' has the immutable-bit set.
Warning: File '/sbin/ifconfig' has the immutable-bit set.
Warning: File '/sbin/ifdown' has the immutable-bit set.
Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable
Warning: File '/sbin/ifup' has the immutable-bit set.
Warning: The command '/sbin/ifup' has been replaced by a script: /sbin/ifup: Bourne-Again shell script text executable
Warning: File '/sbin/init' has the immutable-bit set.
Warning: File '/sbin/insmod' has the immutable-bit set.
Warning: File '/sbin/ip' has the immutable-bit set.
Warning: File '/sbin/lsmod' has the immutable-bit set.
Warning: File '/sbin/modinfo' has the immutable-bit set.
Warning: File '/sbin/modprobe' has the immutable-bit set.
Warning: File '/sbin/nologin' has the immutable-bit set.
Warning: File '/sbin/rmmod' has the immutable-bit set.
Warning: File '/sbin/runlevel' has the immutable-bit set.
Warning: File '/sbin/sulogin' has the immutable-bit set.
Warning: File '/sbin/sysctl' has the immutable-bit set.
Warning: File '/sbin/syslogd' has the immutable-bit set.
Warning: File '/usr/sbin/adduser' has the immutable-bit set.
Warning: No hash value found for file '/usr/sbin/amd' in the rkhunter.dat file.
Warning: File '/usr/sbin/amd' has the immutable-bit set.
Warning: File '/usr/sbin/chroot' has the immutable-bit set.
Warning: File '/usr/sbin/groupadd' has the immutable-bit set.
Warning: File '/usr/sbin/groupdel' has the immutable-bit set.
Warning: File '/usr/sbin/groupmod' has the immutable-bit set.
Warning: File '/usr/sbin/grpck' has the immutable-bit set.
Warning: File '/usr/sbin/kudzu' has the immutable-bit set.
Warning: File '/usr/sbin/lsof' has the immutable-bit set.
Warning: File '/usr/sbin/prelink' has the immutable-bit set.
Warning: File '/usr/sbin/pwck' has the immutable-bit set.
Warning: File '/usr/sbin/sestatus' has the immutable-bit set.
Warning: File '/usr/sbin/tcpd' has the immutable-bit set.
Warning: File '/usr/sbin/useradd' has the immutable-bit set.
Warning: File '/usr/sbin/userdel' has the immutable-bit set.
Warning: File '/usr/sbin/usermod' has the immutable-bit set.
Warning: File '/usr/sbin/vipw' has the immutable-bit set.
Warning: File '/usr/sbin/xinetd' has the immutable-bit set.
Warning: Dreams Rootkit [ Warning ]
File '/usr/bin/sense' found
File '/usr/bin/sl2' found
File '/usr/bin/(swapd)' found
Warning: Checking for possible rootkit strings [ Warning ]
Found string '/dev/ttyoa' in file '/bin/netstat'. Possible rootkit: Sin Rootkit
Warning: Found possible sniffer log file: /usr/lib/libice.log
Warning: Found enabled xinetd service: /etc/xinetd.d/auth
Warning: Found enabled xinetd service: /etc/xinetd.d/cups-lpd
Warning: Found enabled xinetd service: /etc/xinetd.d/swat
Warning: Found enabled xinetd service: /etc/xinetd.d/vmware-authd
Warning: Possible promiscuous interfaces:
'ifconfig' command output:
'ip' command output: eth0
Warning: Account 'test' is root equivalent (UID = 0)
Warning: Account 'james' is root equivalent (UID = 0)
Warning: Account 'master' is root equivalent (UID = 0)
Warning: Account 'admin' is root equivalent (UID = 0)
Warning: The SSH configuration option 'PermitRootLogin' has not been set.
The default value may be 'yes', to allow root access.
Warning: The SSH configuration option 'Protocol' has not been set.
The default value may be '2,1', to allow the use of protocol version 1.
Warning: Hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
Warning: Application 'exim', version '4.43', is out of date, and possibly a security risk.
Warning: Application 'gpg', version '1.2.6', is out of date, and possibly a security risk.
Warning: Application 'openssl', version '0.9.7a', is out of date, and possibly a security risk.
Warning: Application 'php', version '4.3.9', is out of date, and possibly a security risk.
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
結(jié)果就是“中招”,基本上就是重新安裝系統(tǒng)的命了。不過從檢查的結(jié)果來看,可以判斷所中的rootkit的類型和被替換的系統(tǒng)文件。同時對一些程序版本進行檢測,提供的信息比較多。
2.3 指令參數(shù)說明
#/usr/local/bin/rkhunter
Usage: rkhunter {--check | --update | --versioncheck |
--propupd [{filename | directory | package name},...] |
--list [{tests | {lang | languages} | rootkits},...] |
--version | --help} [options]
Current options are:
--append-log 在日志文件后追加日志,而不覆蓋原有日志
--bindir <directory>... Use the specified command directories
-c, --check 檢測當(dāng)前系統(tǒng)
--cs2, --color-set2 Use the second color set for output
--configfile <file> 使用特定的配置文件
--cronjob 作為cron定期運行
(包含參數(shù) -c, --sk , --nocolors )
--dbdir <directory> Use the specified database directory
--debug Debug模式(不要使用除非要求使用)
--disable <test>[,<test>...] 跳過指定檢查對象(默認(rèn)為無)
--display-logfile 在最后顯示日志文件內(nèi)容
--enable <test>[,<test>...] 對指定檢測對象進行檢查
(默認(rèn)檢測所有對象)
--hash {MD5 | SHA1 | NONE | 使用指定的文件哈希函數(shù)
<command>} (Default is SHA1)
-h, --help 顯示幫助菜單
--lang, --language <language> 指定使用的語言
(Default is English)
--list [tests | languages | 羅列測試對象明朝,使用語言,可檢測的木馬程序
rootkits]
-l, --logfile [file] 寫到指定的日志文件名
(Default is /var/log/rkhunter.log)
--noappend-log 不追加日志,直接覆蓋日志文件
--nocolors 輸出只顯示黑白兩色
--nolog 不寫入日志文件
--nomow, --no-mail-on-warning 如果有警告信息,不發(fā)送郵件
--ns, --nosummary 不顯示檢查結(jié)果的統(tǒng)計數(shù)據(jù)
--novl, --no-verbose-logging 不顯示詳細(xì)記錄
--pkgmgr {RPM | DPKG | BSD | 使用特定的包管理用于文件的哈希值驗證
NONE} (Default is NONE)
--propupd [file | directory | 更新整個文件屬性數(shù)據(jù)庫或僅僅更新指定條目
package]...
-q, --quiet 安靜模式(no output at all)
--rwo, --report-warnings-only 只顯示警告信息
-r, --rootdir <directory> 使用指定的root目錄
--sk, --skip-keypress 自動完成所有檢測,跳過鍵盤輸入
--summary 顯示檢測結(jié)果的統(tǒng)計信息
(This is the default)
--syslog [facility.priority] 記錄檢測啟動和結(jié)束時間到系統(tǒng)日志中
(Default level is authpriv.notice)
--tmpdir <directory> 使用指定的臨時目錄
--update 檢測更新內(nèi)容
--vl, --verbose-logging 使用詳細(xì)日志記錄 (on by default)
-V, --version 顯示版本信息
--versioncheck 檢測最新版本
-x, --autox 當(dāng)X在使用時,自動啟動檢測
-X, --no-autox 當(dāng)X在使用時,不自啟檢測
相關(guān)文章
職場人慌了! DeepSeek配合Mermaid自動繪圖的技巧
DeepSeek這玩意兒,配合Mermaid,自動生成甘特圖,這速度,這效率,簡直了神奇了,下面我們就來看看用法2025-03-05- 今天匯總15個很值得收藏的DeepSeek 提示詞,包含職場打工人必備,自媒體爆款創(chuàng)作,學(xué)生黨逆襲,個人成長開掛等等全方面2025-03-04
如何在iPhone上部署DeepSeek-R1? DeepSeek-R1在手機上部署全攻略
你以為只在大機器上跑的模型,其實在手機上也能玩得轉(zhuǎn)!為了體驗一下國產(chǎn)模型的魅力,我在蘋果手機上部署了DeepSeek-R1 1.5B版,詳細(xì)步驟如下2025-03-01- 我們之前分享了很多DeepSeek安裝及本地部署教程,今天我們來看看怎么馴化DeepSeek為自己服務(wù),下面我們就來看看DeepSeek 7天指導(dǎo)手冊2025-02-21
手機端本地部署 Deepseek +桌面端 Deepseek 搭建知識庫指南
關(guān)于 Deepseek,這段時間也傳來不少新聞,本文將介紹如何在安卓手機和桌面設(shè)備上分別部署本地運行的 Deepseek R1 模型,并搭建知識庫,詳細(xì)如下文2025-02-21DeepSeek-R1 與 AnythingLLM 安裝部署本地知識庫詳細(xì)教程
DeepSeek R1是目前最火的大模型,近來有很多朋友問怎么搭建DeepSeek 本地知識庫,在這里分享一種使用DeepSeek + AnythingLLM快速搭建本地知識庫的方法,完全本地化,懶人必2025-02-20DeepSeek怎么獲取官方API? 一文教會你獲取DeepSeek官方API技巧
想要體驗DeepSeek,該怎么貨期官方API呢?下面我們就來看看獲取DeepSeek官方API的詳細(xì)圖文教程2025-02-12DeepSeek怎么一秒生成工作表目錄? DeepSeek辦公自動化的技巧
面對日益增長的數(shù)據(jù)量和復(fù)雜多變的業(yè)務(wù)需求,傳統(tǒng)的Excel操作方式在效率和靈活性上逐漸顯露出不足,如果接入DeepSeek就可以補足缺陷,詳細(xì)請看下文介紹2025-02-12DeepSeek入門必備技巧與隱藏功能! DeepSeek新手使用指南
幾乎一夜之間,所有人都在關(guān)注DeepSeek,今天就來聊一聊DeepSeek,從什么是DeepSeek開始,到火爆原因,怎么下載使用,以及使用場合和隱藏功能分享,詳細(xì)如下2025-02-12DeepSeek卡頓延遲問題怎么解決? 流暢使用DeepSeek的方法大全
由于deepseek人氣越來越高,讓越來越多人開始使用deepseek,另一方面由于前陣子登錄熱搜的外網(wǎng)網(wǎng)絡(luò)攻擊,導(dǎo)致用戶在使用時常常還沒說幾句話,就出現(xiàn)服務(wù)器繁忙字樣,或使用2025-02-12