欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  科技

rootkit的检测工具使用介绍(chkrootkit和rootkit hunter)

程序员文章站 2023-11-08 22:55:58
rootkit的检测工具使用介绍(chkrootkit和rootkit hunter)...

用了两个工具,一个chkrootkit,另外一个rootkit huntur。在使用了这两个产品后,觉得rootkit的信息更加详细一些。现在就对两个工具的操作和使用写一个记录,也方便之后自己查看。

1. chkrootkit的使用
project: http://www.chkrootkit.org
download: ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

1.1 解压安装
#tar -zxvf chkrootkit.tar.gz
#make sense

1.2 运行监测
#./chkrootkit
运行结果在
http://blogimg.chinaunix.net/blog/upfile2/090326111017.pdf
判断有问题的信息如下:
checking `ifconfig'... infected
checking `ls'... infected
checking `netstat'... infected
checking `ps'... infected
checking `top'... infected
searching for madalin rootkit default files... possible madalin rootkit installed
checking `bindshell'... infected (ports: 145)
checking `lkm'... you have 77 process hidden for readdir command
you have 77 process hidden for ps command
chkproc: warning: possible lkm * installed
checking `sniffer'... eth0: promisc

不幸中招,系统只能够重新安装了。在看了这个文档之后,对chkrootkit这个工具又看了一些其他资料。可以做rootkit的自动检查操作
具体可以看 http://www.centospub.com/make/chkrootkit.html

1.3 chkrootkit参数说明
usage: ./chkrootkit [options] [test ...]
options:
-h 显示帮助信息
-v 显示版本信息
-l 显示测试内容
-d debug模式,显示检测过程的相关指令程序
-q 安静模式,只显示有问题部分,
-x 高级模式,显示所有检测结果
-r dir 设定指定的目录为根目录
-p dir1:dir2:dirn 检测指定目录
-n 跳过nfs连接的目录

2. rootkit hunter的使用
project: http://www.rootkit.nl/projects/rootkit_hunter.html
download: http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.4.tar.gz?use_mirror=jaist

2.1 解压安装
解压
#tar -zxvf rkhunter-1.3.4.tar.gz
安装
#cd rkhunter-1.3.4
#./installer.sh -h
usage: ./installer.sh <parameters>
ordered valid parameters:
--help (-h) : 显示帮助
--examples : 显示安装实例
--layout <value> : 选择安装模板(安装必选参数).
模板选择:
- default: (fhs compliant),
- /usr,
- /usr/local,
- oldschool: 之前版本安装路径,
- custom: 自定义安装路径,
- rpm: for building rpm's. requires $rpm_build_root.
- deb: for building deb's. requires $deb_build_root.
--striproot : strip path from custom layout (for package maintainers).
--install : 根据选择目录安装
--show : 显示安装路径
--remove : 卸载rkhunter
--version : 显示安装版本


我使用的安装指令
#./installer.sh --layout default --install

2.2 rkhunter操作
#/usr/local/bin/rkhunter --propupd
#/usr/local/bin/rkhunter -c --sk --rwo

warning: file '/bin/awk' has the immutable-bit set.
warning: file '/bin/basename' has the immutable-bit set.
warning: file '/bin/bash' has the immutable-bit set.
warning: file '/bin/cat' has the immutable-bit set.
warning: file '/bin/chmod' has the immutable-bit set.
warning: file '/bin/chown' has the immutable-bit set.
warning: file '/bin/cp' has the immutable-bit set.
warning: file '/bin/csh' has the immutable-bit set.
warning: file '/bin/cut' has the immutable-bit set.
warning: file '/bin/date' has the immutable-bit set.
warning: file '/bin/df' has the immutable-bit set.
warning: file '/bin/dmesg' has the immutable-bit set.
warning: file '/bin/echo' has the immutable-bit set.
warning: file '/bin/ed' has the immutable-bit set.
warning: file '/bin/egrep' has the immutable-bit set.
warning: file '/bin/env' has the immutable-bit set.
warning: file '/bin/fgrep' has the immutable-bit set.
warning: file '/bin/grep' has the immutable-bit set.
warning: file '/bin/kill' has the immutable-bit set.
warning: file '/bin/login' has the immutable-bit set.
warning: file '/bin/ls' has the immutable-bit set.
warning: file '/bin/mail' has the immutable-bit set.
warning: file '/bin/mktemp' has the immutable-bit set.
warning: file '/bin/more' has the immutable-bit set.
warning: file '/bin/mount' has the immutable-bit set.
warning: file '/bin/mv' has the immutable-bit set.
warning: file '/bin/netstat' has the immutable-bit set.
warning: file '/bin/ps' has the immutable-bit set.
warning: file '/bin/pwd' has the immutable-bit set.
warning: file '/bin/rpm' has the immutable-bit set.
warning: file '/bin/sed' has the immutable-bit set.
warning: file '/bin/sh' has the immutable-bit set.
warning: file '/bin/sort' has the immutable-bit set.
warning: file '/bin/su' has the immutable-bit set.
warning: file '/bin/touch' has the immutable-bit set.
warning: file '/bin/uname' has the immutable-bit set.
warning: file '/bin/gawk' has the immutable-bit set.
warning: file '/bin/tcsh' has the immutable-bit set.
warning: file '/usr/bin/awk' has the immutable-bit set.
warning: file '/usr/bin/cut' has the immutable-bit set.
warning: file '/usr/bin/env' has the immutable-bit set.
warning: the command '/usr/bin/get' has been replaced by a script: /usr/bin/get: perl script text executable
warning: the command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: bourne shell script text executable
warning: file '/usr/bin/kill' has the immutable-bit set.
warning: the command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: bourne shell script text executable
warning: file '/usr/bin/top' has the immutable-bit set.
warning: the command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: bourne shell script text executable
warning: file '/usr/bin/gawk' has the immutable-bit set.
warning: file '/sbin/chkconfig' has the immutable-bit set.
warning: file '/sbin/depmod' has the immutable-bit set.
warning: file '/sbin/fuser' has the immutable-bit set.
warning: file '/sbin/ifconfig' has the immutable-bit set.
warning: file '/sbin/ifdown' has the immutable-bit set.
warning: the command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: bourne-again shell script text executable
warning: file '/sbin/ifup' has the immutable-bit set.
warning: the command '/sbin/ifup' has been replaced by a script: /sbin/ifup: bourne-again shell script text executable
warning: file '/sbin/init' has the immutable-bit set.
warning: file '/sbin/insmod' has the immutable-bit set.
warning: file '/sbin/ip' has the immutable-bit set.
warning: file '/sbin/lsmod' has the immutable-bit set.
warning: file '/sbin/modinfo' has the immutable-bit set.
warning: file '/sbin/modprobe' has the immutable-bit set.
warning: file '/sbin/nologin' has the immutable-bit set.
warning: file '/sbin/rmmod' has the immutable-bit set.
warning: file '/sbin/runlevel' has the immutable-bit set.
warning: file '/sbin/sulogin' has the immutable-bit set.
warning: file '/sbin/sysctl' has the immutable-bit set.
warning: file '/sbin/syslogd' has the immutable-bit set.
warning: file '/usr/sbin/adduser' has the immutable-bit set.
warning: no hash value found for file '/usr/sbin/amd' in the rkhunter.dat file.
warning: file '/usr/sbin/amd' has the immutable-bit set.
warning: file '/usr/sbin/chroot' has the immutable-bit set.
warning: file '/usr/sbin/groupadd' has the immutable-bit set.
warning: file '/usr/sbin/groupdel' has the immutable-bit set.
warning: file '/usr/sbin/groupmod' has the immutable-bit set.
warning: file '/usr/sbin/grpck' has the immutable-bit set.
warning: file '/usr/sbin/kudzu' has the immutable-bit set.
warning: file '/usr/sbin/lsof' has the immutable-bit set.
warning: file '/usr/sbin/prelink' has the immutable-bit set.
warning: file '/usr/sbin/pwck' has the immutable-bit set.
warning: file '/usr/sbin/sestatus' has the immutable-bit set.
warning: file '/usr/sbin/tcpd' has the immutable-bit set.
warning: file '/usr/sbin/useradd' has the immutable-bit set.
warning: file '/usr/sbin/userdel' has the immutable-bit set.
warning: file '/usr/sbin/usermod' has the immutable-bit set.
warning: file '/usr/sbin/vipw' has the immutable-bit set.
warning: file '/usr/sbin/xinetd' has the immutable-bit set.
warning: dreams rootkit [ warning ]
file '/usr/bin/sense' found
file '/usr/bin/sl2' found
file '/usr/bin/(swapd)' found
warning: checking for possible rootkit strings [ warning ]
found string '/dev/ttyoa' in file '/bin/netstat'. possible rootkit: sin rootkit
warning: found possible sniffer log file: /usr/lib/libice.log
warning: found enabled xinetd service: /etc/xinetd.d/auth
warning: found enabled xinetd service: /etc/xinetd.d/cups-lpd
warning: found enabled xinetd service: /etc/xinetd.d/swat
warning: found enabled xinetd service: /etc/xinetd.d/vmware-authd
warning: possible promiscuous interfaces:
'ifconfig' command output:
'ip' command output: eth0
warning: account 'test' is root equivalent (uid = 0)
warning: account 'james' is root equivalent (uid = 0)
warning: account 'master' is root equivalent (uid = 0)
warning: account 'admin' is root equivalent (uid = 0)
warning: the ssh configuration option 'permitrootlogin' has not been set.
the default value may be 'yes', to allow root access.
warning: the ssh configuration option 'protocol' has not been set.
the default value may be '2,1', to allow the use of protocol version 1.
warning: hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from unix, max compression
warning: application 'exim', version '4.43', is out of date, and possibly a security risk.
warning: application 'gpg', version '1.2.6', is out of date, and possibly a security risk.
warning: application 'openssl', version '0.9.7a', is out of date, and possibly a security risk.
warning: application 'php', version '4.3.9', is out of date, and possibly a security risk.
one or more warnings have been found while checking the system.
please check the log file (/var/log/rkhunter.log)

结果就是“中招”,基本上就是重新安装系统的命了。不过从检查的结果来看,可以判断所中的rootkit的类型和被替换的系统文件。同时对一些程序版本进行检测,提供的信息比较多。

2.3 指令参数说明
#/usr/local/bin/rkhunter
usage: rkhunter {--check | --update | --versioncheck |
--propupd [{filename | directory | package name},...] |
--list [{tests | {lang | languages} | rootkits},...] |
--version | --help} [options]

current options are:
--append-log 在日志文件后追加日志,而不覆盖原有日志
--bindir <directory>... use the specified command directories
-c, --check 检测当前系统
--cs2, --color-set2 use the second color set for output
--configfile <file> 使用特定的配置文件
--cronjob 作为cron定期运行
(包含参数 -c, --sk , --nocolors )
--dbdir <directory> use the specified database directory
--debug debug模式(不要使用除非要求使用)
--disable <test>[,<test>...] 跳过指定检查对象(默认为无)
--display-logfile 在最后显示日志文件内容
--enable <test>[,<test>...] 对指定检测对象进行检查
(默认检测所有对象)
--hash {md5 | sha1 | none | 使用指定的文件哈希函数
<command>} (default is sha1)
-h, --help 显示帮助菜单
--lang, --language <language> 指定使用的语言
(default is english)
--list [tests | languages | 罗列测试对象明朝,使用语言,可检测的木马程序
rootkits]
-l, --logfile [file] 写到指定的日志文件名
(default is /var/log/rkhunter.log)
--noappend-log 不追加日志,直接覆盖日志文件
--nocolors 输出只显示黑白两色
--nolog 不写入日志文件
--nomow, --no-mail-on-warning 如果有警告信息,不发送邮件
--ns, --nosummary 不显示检查结果的统计数据
--novl, --no-verbose-logging 不显示详细记录
--pkgmgr {rpm | dpkg | bsd | 使用特定的包管理用于文件的哈希值验证
none} (default is none)
--propupd [file | directory | 更新整个文件属性数据库或仅仅更新指定条目
package]...
-q, --quiet 安静模式(no output at all)
--rwo, --report-warnings-only 只显示警告信息
-r, --rootdir <directory> 使用指定的root目录
--sk, --skip-keypress 自动完成所有检测,跳过键盘输入
--summary 显示检测结果的统计信息
(this is the default)
--syslog [facility.priority] 记录检测启动和结束时间到系统日志中
(default level is authpriv.notice)
--tmpdir <directory> 使用指定的临时目录
--update 检测更新内容
--vl, --verbose-logging 使用详细日志记录 (on by default)
-v, --version 显示版本信息
--versioncheck 检测最新版本
-x, --autox 当x在使用时,自动启动检测
-x, --no-autox 当x在使用时,不自启检测

相关标签: ROOTKIT chkrootkit