LinuxSoft


rkdet ˥ƥư

rkdet äƲ

rkdet = rootkit detector for Linux (Linux ѥ롼ȥåȸХġ)

ps ޥɤ kill ޥɤ⤵Ƥޤäơ⡼Ȥ鳺Ф褦ȤƤ館ʤ礬ޤ®Ф LAN ֥ȴơ®䤫 OS Υ꡼󥤥󥹥ȡ뤪줬ɬפȤʤ櫓Ǥ

rkdet ȤХƥΰ۾򸡽Фȼưǡ/sbin/ifconfig eth0 downפ¹ԤƤޤͥåȥ䥵дԤˤȤäͭ񤤥ǡ rkdet Ǥˤ⤷Ƥﳲɬ׺Ǿ¤ˤȤɤ뤳ȤޤͥåȥڤΥƤޤС⤦򤵤뿴ۤ⤢ޤ󤷡򤦤ФƧȤʤäơ˥ͥåȥ򥹥󤵤ƤޤȤ⤢ޤ

ǡȤƤ̤ʤΤǡȤꤢƻѤȤޤݸȤƥƥ˥󥹥ȡ뤷ƤΤޤ

ʤߤ˥ͥåȥڤΥ root ˥᡼褦ʻȤߤˤʤäƤޤŸǥ쥯ȥˤ xstrings.txt ʸѤ뤳Ȥǡ᡼̾λǤޤ

mailfmt;4;/bin/mail -s 'Intrusion Report for %s' root

ޤåθоݤƱŸǥ쥯ȥˤ xfiles.txt ˤäƻǤޤʲɸθоݰǤ

/usr/bin/md5sum
/usr/sbin/rkdet
/bin/ps
/bin/ls
/bin/netstat
/bin/login
/usr/bin/du
/usr/bin/find
/usr/bin/crontab
/usr/bin/killall
/bin/kill
/usr/bin/passwd
/usr/bin/top
/usr/sbin/sshd
/usr/bin/md5sum
/lib/libcrypt.so.1
/lib/libpam.so.0
/lib/libpam_misc.so.0

ܤɥȤγREADME ܸ

rkdet

rkdet Υ饤

ե꡼եȥʤΤ̵ѤǤޤԤ˴դǤ͡

License:
rkdet is freeware. rkdet incorporates code by David A. Curry
from "ifstatus", which is in the public domain.

(README)

rkdet Υ󥹥ȡ

󥹥ȡȼΤϼڤǤȴĶ Fedora Core 4 Ǥؤɤ Red Hat Linux ϥƥƱͤ˥󥹥ȡǤޤ

1. ꤷŸǥ쥯ȥưޤʤΤϤ«

$ wget http://vancouver-webpages.com/rkdet/rkdet-0.53.tar.gz
$ tar xfz rkdet-0.53.tar.gz
$ cd rkdet-0.53

2. configure Ǥü˿ʤߤޤŪ˲ͤ 󥿡Ϣ³ OK Ǥ

# ./configure
Choose name for rkdet (recommend renaming)
rkdet
Select checksum program:
/usr/bin/md5sum
Select mail command:
"/bin/mail -s 'Intrusion Report for %s' root"
Select startup message:
(See your network guru for details)
Select run argument (see documentation):
163
Select netstat:
/bin/netstat
Select WAN disconnect command:
/sbin/route del default
Select LAN disconnect command:
/sbin/ifconfig eth0 down
Select logfile:
/var/log/rkdet.log
Select who command:
/usr/bin/w
Select down message:
"Checksum failure - disconnecting network"
Select mail subject:
"Intruder Report for"
Select kill message:
"Attempt to kill rkdet"
Select delete tool:
/bin/rm
Choose install directory
/usr/sbin
Select files to check:
ps (/bin/ps)
ls (/bin/ls)
netstat (/bin/netstat)
login (/bin/login)
inetd ()
  not found; will not check inetd
du (/usr/bin/du)
find (/usr/bin/find)
crontab (/usr/bin/crontab)
killall (/usr/bin/killall)
kill (/bin/kill)
passwd (/usr/bin/passwd)
top (/usr/bin/top)
sshd (/usr/sbin/sshd)
md5sum (/usr/bin/md5sum)
libcrypt.so.1 (/lib/libcrypt.so.1)
libpam.so.0 (/lib/libpam.so.0)
libpam_misc.so.0 (/lib/libpam_misc.so.0)

3. make, install ޤ

$ make
# make install

4. ӥϿޤ

# /sbin/chkconfig --add rkdet

ʤưǥ٥ 345 ǵư褦ˤʤäƤΤǡäѤʤƤ⥵еư˼ư¹Ԥޤ

# /sbin/chkconfig --list rkdet
rkdet           0:off   1:off   2:on    3:on    4:on    5:on    6:off

5. ӥưޤ

# /sbin/service rkdet start
Starting rkdet
(See your network guru for details)                        [  OK  ]

6. ǰΤץǧޤ

ps ax | grep rkdet
 8253 ?        Ss     0:00 rkdet 163

Τ褦 rkdet ȤǡưƤΤǧǤޤ

ɥ

ñʼϥƥ

ºݤ˻ʤʬʤ(w ȤȤǡ¸Ƥߤޤ¸Τ /bin/ls Ǥ

# cp -p /bin/ls /bin/ls.org

ޤϡХååפäơ

# vi /bin/ls

ǡŬ˥Хʥʸޤ

ġĤǻäȡġĎ(ߢώ)!!

ʤͥåȥȤޤΥޥɤäǤǡ󥿡ΥޥȤƤΤǤ

ǡΥޥ򥳥󥽡뤫ĤʤǤߤȡ eth0 󥿥ե󤵤ƤޤȵǽƤޤ͡󥽡ˤϤɽ

sion rkedet : Checksum failuer - disconnecting network

sion ȤΤϤΥƥȤ򤷤ۥ̾Ǥ

ĤǤˡ᡼åȡġĤФä /bin/ls Υåब㤦ȤŦȡλ w netstat ³ԾɽƤޤǤ͡äۥƥ󥰤ƤޥˤȤ߹Ǥʡ

From root@sion.pocketstudio.jp  Tue Jul 19 16:06:05 2005
Return-Path: <root@sion.pocketstudio.jp>
Received: from sion.pocketstudio.jp (sion [127.0.0.1])
        by sion.pocketstudio.jp (8.13.4/8.13.4) with ESMTP id j6J7657j009783
        (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
        for <root@sion.pocketstudio.jp>; Tue, 19 Jul 2005 16:06:05 +0900
Received: (from root@localhost)
        by sion.pocketstudio.jp (8.13.4/8.13.4/Submit) id j6J765Xs009780
        for root; Tue, 19 Jul 2005 16:06:05 +0900
Date: Tue, 19 Jul 2005 16:06:05 +0900
From: root <root@sion.pocketstudio.jp>
Message-Id: <200507190706.j6J765Xs009780@sion.pocketstudio.jp>
To: root@sion.pocketstudio.jp
Subject: Intrusion Report for sion

Intruder Report for sion
Tue Jul 19 16:06:05 2005


Checksums differ: /bin/ls
 16:06:05 up  9:49,  4 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1     -                16:01    4:01   0.13s  0.13s -bash
zem      pts/0    sakura2.internal 14:37    1:19m  0.04s  0.02s sshd: zem [priv
zem      pts/1    sakura2.internal 10:42    5:24   0.22s  0.02s sshd: zem [priv
zem      pts/2    sakura2.internal 16:05    2.00s  0.04s  0.02s sshd: zem [priv
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:1290  ESTABLISHED
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:2283  ESTABLISHED
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:2806  ESTABLISHED

ޤ᡼ƱͤΥ /var/log/rkdat.log ե˵Ͽޤ

# cat /var/log/rkdet.log

Intruder Report for sion
Tue Jul 19 16:06:05 2005


Checksums differ: /bin/ls
 16:06:05 up  9:49,  4 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1     -                16:01    4:01   0.13s  0.13s -bash
zem      pts/0    sakura2.internal 14:37    1:19m  0.04s  0.02s sshd: zem [priv
zem      pts/1    sakura2.internal 10:42    5:24   0.22s  0.02s sshd: zem [priv
zem      pts/2    sakura2.internal 16:05    2.00s  0.04s  0.02s sshd: zem [priv
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:1290  ESTABLISHED
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:2283  ESTABLISHED
tcp        0      0 ::ffff:192.168.11.253:22    ::ffff:192.168.11.102:2806  ESTABLISHED

ΥեȤ promiscus ⡼ɤ򸡽ФȾ˥ͥåȥȤΤǡpromicsus ⡼ɤȤ nmap ȤȤ rkdet ߤʤȤޤ͡ľܥ󥽡򿨤äƥǡߤ뤫֡ȤʤƤϤʤʤꤽǤ


ȥå   Խ ʬ Хåå ź ʣ ̾ѹ   ñ측 ǽ   إ   ǽRSS
Last-modified: Tue, 19 Jul 2005 19:47:03 JST (5423d)