i18nchk

在网络安全中经常会遇到rootkit

#! /usr/bin/perl -w

#
# A simple util to check the lines in the i18n/en file
# exist in the rkhunter program.
#
# Author: John Horne (17-2-07)
#

my $keyword = my $arg = my $found = '';

my $dir = '/var/lib/rkhunter/db/i18n';
my $rkh = '/usr/local/bin';


while (@ARGV) {
	$arg = shift;

	if ($arg =~ /^--?d$/io) {
		$dir = shift;
	}
	elsif ($arg =~ /^--?p$/io) {
		$rkh = shift;
	}
	elsif ($arg =~ /^--?h$/io) {
		print "\nUsage: i18nchk [-d i18n_dir] [-p rkhunter_dir]\n\n";
		exit;
	}
	else {
		print "Unknown option: $arg\n";
		exit 1;
	}
}


if (! $dir || ! -d $dir) {
	print "Unable to find the i18n directory.\n";
	exit 1;
}
elsif (! $rkh || ! -d $rkh) {
	print "Unable to find the rkhunter program.\n";
	exit 1;
}


unless (open(I18N, "$dir/en")) {
	print "Unable to open i18n file: $!\n";
	exit 1;
}

while (defined($keyword = <I18N>)) {
	next if ($keyword =~ /^\s*(#|$)/o);
	next if ($keyword =~ /^version:/io);
	next if ($keyword eq "MSG_TYPE_PLAIN:\n");

	chomp($keyword);

	if ($keyword =~ /^([^:]+):\s*\S/o) {
		$keyword = $1;
	}
	else {
		print "Keyword $keyword has no value.\n";
	}

	$keyword = $1 if ($keyword =~ /^MSG_TYPE_(.*)/o);
	$keyword = $1 if ($keyword =~ /^MSG_RESULT_(.*)/o);

	if ($keyword =~ /[a-z]/o) {
		print "Keyword $keyword contains lowercase characters.\n";
	}

	$found = `egrep -e " $keyword( |\$)" $rkh/rkhunter`;

	unless ($found) {
		print "Keyword $keyword not found in rkhunter.\n";
	}

#	print "$keyword\n";
}

close(I18N);

exit;