Just a last minute post about the must have app that I actually forgot up until just now to throw on my server! Eeks!~
(fortunately no one read’s this blog, and even less would want to get into the old laptop hosting this anyways)
But, it is connected to the internet making any bot-net controller at least a little tempted I suppose. Granted I would not be high on this list either, being I’m very cautious on link’s and email and high security passwords (thank you keepass!) but alas, as Steve Gibson always says, “Trust No One.” or TNO for you Security Now listeners and well, he’s right. (as he is most of the time)
So being that we’re all scared of the power that a root kit does wield for an attacker being able to hide in plain sight we want to find those discrepincy’s Enter in chkrootkit.
With support for linux 2.0.x - 2.6.x, Open/Free/Net BSD, Mac OS X, and friends we can quickly see that it’s also very nice to be standards based. (Yea OpenSource!)
here’s a quick sample of it’s output as it scan’s away:
Checking `netstat'... not infected
Checking `named'... not found
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not found
Checking `sshd'... not infected
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
As you can see it’s been truncated to save you the joy of reading 2 pages of output, but you get the point and an idea of what it’s doing.
If you dont have it yet, I recommend getting it! Being I’m a debian guy, I’ll show you the joy of apt-get and how it makes installing software even easier then on windows.
First off I’m going to say this. NEVER run as root!
so if your running debian and havent yet, let’s go get nano (a text editor) and sudo (super user temp rights) first!
as root (represented by # but not typed):
# apt-get install nano sudo
and type in y when asked if you want to continue.
now let’s give you rights in the sudoers file:
# visudo
and let’s add the line substituting your username for “user”:
root ALL=(ALL) ALL
user ALL=(ALL) ALL
Press Ctrl+X to save and press Enter to save using the same filename
Now wait. you might not know it yet as chkrootkit’s still not installed but you’ve already installed and setup 2 very useful and solid applications! was that hard? NOPE!
Alright now log out of the root user either by opening a new terminal window (if your in the gui) or just typing in exit and returning to your normal user.
It’s all downhill from here! to issue commands that need root access without logging in as root, and not having to use the super secure and ungodly long password you setup your root account with (right?) let’s issue our first sudo command as a normal user (represented by $ but not typed) and install chkrootkit at the same time! Ready?!!?
sudo apt-get install chkrootkit
now just type in your normal users password to continue, this will be remembered until you close the session or logout so you dont have to type it in again and again. Now just let it do it’s thing!
Once it’s finished, to run it, just type in:
sudo chkrootkit
go over the output and look for things that might stand out, such as “Infected” or a list of file’s or directories. Happy Root Kit Hunting!
)
