1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
From: Richard Lewis <richard.lewis.debian@googlemail.com>
Date: Wed, 16 Oct 2024 09:02:12 +0100
Subject: chkrootkit: slapper
Use OPT="-an" with ss and netstat
Redirect stderr to /dev/null on every command in a pipeline, not just
the last one (this is helpful for non-root users on eg android, where
netstat is not accessible)
Improve output
Forwarded: yes
(Forwarded by email: 21 Dec 2024)
---
chkrootkit | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
diff --git a/chkrootkit b/chkrootkit
index b2c6863..9284934 100755
--- a/chkrootkit
+++ b/chkrootkit
@@ -104,29 +104,28 @@ slapper (){
SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \
${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"
SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "
- _chk_netstat_or_ss;
- OPT="-an"
- [ "${netstat}" = "ss" ] && OPT="-a"
+ _chk_netstat_or_ss;
+ OPT="-an"
STATUS=0
- file_port=
+ file_port=""
- if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}"> /dev/null 2>&1
- then
+ if ${netstat} "${OPT}" 2>/dev/null | ${egrep} -q "^tcp.+${SLAPPER_PORT}"; then
STATUS=1
- [ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \
- $egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print $7 }' | tr -d :`
+ if [ "$SYSTEM" = "Linux" ]; then
+ file_port=$(${netstat} -p "${OPT}" | \
+ $egrep ^tcp|$egrep "${SLAPPER_PORT}" | "${awk}" '{ print $7 }' | tr -d :)
+ fi
fi
for i in ${SLAPPER_FILES}; do
- if [ -f ${i} ]; then
- file_port="$file_port $i"
- STATUS=1
- fi
+ if [ -f "${i}" ]; then
+ file_port=$(_filter "$i" "$file_port")
+ STATUS=1
+ fi
done
- if [ ${STATUS} -eq 1 ] ;then
- echo "Warning: Possible Slapper Worm installed ($file_port)"
+ if [ "${STATUS}" -eq 1 ] ;then
+ _warn "Possible Slapper Worm installed:\n$file_port\n"
else
- if [ "${QUIET}" != "t" ]; then echo "not infected"; fi
- return ${NOT_INFECTED}
+ _not_found
fi
}
|
