rootkit后门检测工具chkrookit

港控/mmm° 2022-05-17 12:25 544阅读 0赞

**rootkit****后门检测工具****chkrookit**

**1****、编译安装****chkrookit**

官方站点：http://www.chkrootkit.org/

\[root@node1 ~\]\# vim /etc/resolv.conf

**1****）、安装gcc****编译环境**

\[root@node1 ~\]\# yum -y install gcc gcc-c++ make cmake glibc-static glibc-utils

\[root@node1 ~\]\# yum -y install lrzsz

**2****）、下载chkrootkit****包并上传**

\[root@node1 ~\]\# rz

\[root@node1 ~\]\# ls

anaconda-ks.cfg  chkrootkit.tar.gz  mariadb-5.5.61.tar.gz  ~None  :wq

**3****）、解压编译安装：建议官方站点下载源码**

\[root@node1 ~\]\# tar zxvf chkrootkit.tar.gz -C /usr/local/

\[root@node1 chkrootkit-0.52\]\# make sense

\#注意，此处为make sense

cc -static  -o strings-static strings.c

cc  -o chkutmp chkutmp.c

\[root@node1 chkrootkit-0.52\]\#

**2****、****chkrookit****的使用**

**1****）、Usage: ./chkrootkit \[options\] \[test ...\]**

**Options:**

\-h 显示帮助信息

\-V 显示版本信息

\-l 显示测试内容

\-d debug模式，显示检测过程的相关指令程序

\-q 安静模式，只显示有问题部分，

\-x 高级模式，显示所有检测结果

\-p dir1:dir2:dirN 检测指定目录

\-n 跳过NFS连接的目录

**2****）、检测：直接执行chkrootkit****命令即可检测系统**

\[root@node1 ~\]\# /usr/local/chkrootkit-0.52/chkrootkit

...

Checking \`asp'... not infected

Checking \`bindshell'... not infected

Checking \`lkm'... not tested: can't exec

Checking \`rexedcs'... not found

Checking \`sniffer'... not tested: can't exec ./ifpromisc

Checking \`w55808'... not infected

Checking \`wted'... not tested: can't exec ./chkwtmp

Checking \`scalper'... not infected

Checking \`slapper'... not infected

Checking \`z2'... not tested: can't exec ./chklastlog

Checking \`chkutmp'... not tested: can't exec ./chkutmp

Checking \`OSX\_RSPLUG'... not tested

\[root@node1 ~\]\# /usr/local/chkrootkit-0.52/chkrootkit -q

can't exec ./strings-static,

/usr/lib/debug/usr/.dwz /usr/lib/python2.7/site-packages/ansible/galaxy/data/container\_enabled/files/.git\_keep /usr/lib/python2.7/site-packages/ansible/galaxy/data/container\_enabled/templates/.git\_keep /usr/lib/python2.7/site-packages/ansible/galaxy/data/default/files/.git\_keep /usr/lib/python2.7/site-packages/ansible/galaxy/data/default/templates/.git\_keep /usr/lib/ocf/resource.d/heartbeat/.ocf-binaries /usr/lib/ocf/resource.d/heartbeat/.ocf-directories /usr/lib/ocf/resource.d/heartbeat/.ocf-returncodes /usr/lib/ocf/resource.d/heartbeat/.ocf-shellfuncs /usr/lib/ocf/resource.d/.isolation /usr/lib/pcsd/.bundle /usr/lib/pcsd/vendor/bundle/ruby/gems/backports-3.9.1/.document /usr/lib/pcsd/vendor/bundle/ruby/gems/backports-3.9.1/.gitignore /usr/lib/pcsd/vendor/bundle/ruby/gems/backports-3.9.1/.gitmodules /usr/lib/pcsd/vendor/bundle/ruby/gems/backports-3.9.1/.irbrc /usr/lib/pcsd/vendor/bundle/ruby/gems/backports-3.9.1/.travis.yml /usr/lib/pcsd/vendor/bundle/ruby/gems/ethon-0.10.1/.gitignore /usr/lib/pcsd/vendor/bundle/ruby/gems/ethon-0.10.1/.rspec /usr/lib/pcsd/vendor/bundle/ruby/gems/ethon-0.10.1/.travis.yml /usr/lib/pcsd/vendor/bundle/ruby/gems/ffi-1.9.18/ext/ffi\_c/.RUBYARCHDIR.time /usr/lib/pcsd/vendor/bundle/ruby/gems/rpam-ruby19-1.2.1/ext/Rpam/.RUBYARCHDIR.time /usr/lib/pcsd/vendor/bundle/ruby/gems/sinatra-1.4.8/.yardopts

/usr/lib/ocf/resource.d/.isolation /usr/lib/pcsd/.bundle

not tested

not tested: can't exec

not tested: can't exec ./ifpromisc

not tested: can't exec ./chkwtmp

not tested: can't exec ./chklastlog

not tested: can't exec ./chkutmp

not tested

**3****）、查看是否有感染的程序**

\[root@node1 ~\]\# /usr/local/chkrootkit-0.52/chkrootkit |grep INFECTED

**4****）、感染后最安全有效的处理：备份重要数据并重装系统**

**5****）、备份chkrootkit****使用的系统命令**