Fli
07-31-2016, 12:16 PM
How to install chkrootkit (http://www.chkrootkit.org/)?
I used this command:
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz -qO - |tar -xz;cd chkrootkit*;make sense;ls;echo -e "\nchkrootkit script can be launched: ./chkrootkit or moved somewhere else and this dir. $(pwd) removed.\nI launch the script like this: ./chkrootkit|grep -vE \"nothing found|nothing detected|not promisc|Permission denied|nothing deleted|not infected|not found|not tested|no suspect|ROOTDIR\"\nTo move script to the /root/ and remove this install. dir: mv chkrootkit /root/;cd ..;rm -rf chkrootkit-*"
Im excluding unimportant lines like this:
./chkrootkit|grep -vE "nothing found|nothing detected|not promisc|Permission denied|nothing deleted|not infected|not found|not tested|no suspect|ROOTDIR"
Got warnings:
You have 1 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
Checking `bindshell'... INFECTED (PORTS: 465)
but it is mentioned there (http://www.linuxquestions.org/questions/showthread.php?p=1450811#post1450811)as a false positive. 465 is also claimed as false positive on cPanel and similar hosting servers
Another way to install chkrootkit on CentOS:
yum install chkrootkit
I used this command:
wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz -qO - |tar -xz;cd chkrootkit*;make sense;ls;echo -e "\nchkrootkit script can be launched: ./chkrootkit or moved somewhere else and this dir. $(pwd) removed.\nI launch the script like this: ./chkrootkit|grep -vE \"nothing found|nothing detected|not promisc|Permission denied|nothing deleted|not infected|not found|not tested|no suspect|ROOTDIR\"\nTo move script to the /root/ and remove this install. dir: mv chkrootkit /root/;cd ..;rm -rf chkrootkit-*"
Im excluding unimportant lines like this:
./chkrootkit|grep -vE "nothing found|nothing detected|not promisc|Permission denied|nothing deleted|not infected|not found|not tested|no suspect|ROOTDIR"
Got warnings:
You have 1 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
Checking `bindshell'... INFECTED (PORTS: 465)
but it is mentioned there (http://www.linuxquestions.org/questions/showthread.php?p=1450811#post1450811)as a false positive. 465 is also claimed as false positive on cPanel and similar hosting servers
Another way to install chkrootkit on CentOS:
yum install chkrootkit