rpmprelinkhashes.sh

在网络安全中经常会遇到rootkit

#!/bin/sh

echo '-------------------------------------------------------'
cat "$0"
echo '-------------------------------------------------------'

# Files to
FILES="/usr/bin/find /usr/sbin/cron /sbin/ifconfig /usr/bin/watch /usr/bin/w /usr/bin/whoami /usr/bin/who /usr/bin/users /usr/bin/stat /usr/bin/sha1sum /usr/bin/kill /usr/bin/find /usr/bin/file /usr/bin/pstree /usr/bin/killall /usr/bin/lsattr /bin/mount /bin/netstat /bin/egrep /bin/fgrep /bin/grep /bin/cat /bin/chmod /bin/chown /bin/env /bin/ls /bin/su /bin/ps /bin/dmesg /bin/kill /bin/login /sbin/chkconfig /sbin/depmod /sbin/insmod /sbin/modinfo /sbin/sysctl /sbin/syslogd /sbin/init /sbin/runlevel /usr/bin/groups /sbin/ip"

for I in ${FILES}; do
	if [ -f ${I} ]; then
		FILESIZE=`ls -l -- ${I} | tr -s ' ' ',' | cut -d ',' -f5`
		RPM=`rpm -qf -- ${I}`
		# No prelink:
		# MD5=`md5sum ${I} | cut -d ' ' -f1`
		# With prelink (like Fedora):
		MD5=`prelink --verify -- ${I} | md5sum - | cut -d ' ' -f 1`
		SHA1=`prelink --verify -- ${I} | sha1sum - | cut -d ' ' -f 1`
		echo "OSID:${I}:${MD5}:${SHA1}:${FILESIZE}:${RPM}:"
	fi
done
echo '-------------------------------------------------------'