linux-Backdoor intrusion Detection Tool-chkrootkit

Source: Internet
Author: User

Rookit

Introduction: rootkit is a Linux Platform Common Trojan backdoor tool, which mainly by replacing the system files to achieve the purpose of intrusion and concealment, such Trojans than ordinary Trojan backdoor more dangerous and covert, ordinary detection tools and inspection means difficult to find this Trojan. the rootkt attack is extremely powerful and can be very damaging to the system by creating a backdoor and covert tracks through a set of tools that allow the attacker to maintain access to root at all times. permissions to log on to the system.

Rootkit There are two types of files: file-level and kernel-level

Rootkit Backdoor Detection Tool

1) Chkrootkit

Installation

Yum Install gcc gcc++ glibc-static-y

www.chkrootkit.org Download chkrootkit.tar.gz

Tar zxvf chkrootkit.tar.gz

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/7C/63/wKioL1bP3c2jvQNmAAAcnb8XHQE945.png "title=" 1.png " alt= "Wkiol1bp3c2jvqnmaaacnb8xhqe945.png"/>

CD chkrootkit-0.50/

Make sense

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M00/7C/65/wKiom1bP3W6TTjlMAAA82D-HR9E163.png "title=" 2.png " alt= "Wkiom1bp3w6ttjlmaaa82d-hr9e163.png"/>

Cd

MV Chkrootkit-0.50//usr/local/

Use

/usr/local/chkrootkit-0.50/chkrootkit

The meaning of each parameter

- H Display Help information

- v display version information

- L Show test content

- D Debug mode to display relevant commands during the detection process

-Q Quiet mode, showing only problematic content

- x Advanced mode, show all test results

- N Skip over NFS Connected Directories

Chkrootkit Disadvantages

Chkrootkit It's easy to use, but the process uses some system commands, so when a hacker invades, you can replace some system commands, and the results become untrustworthy.

Solve this problem: Back up the system commands before the server is open to the outside.

Mkdir/usr/share/.commands

CP ' which--skip-alias awk ssh Cutecho find egrep ID head ls netstat ps strings sed uname '/usr/share/.commands

/usr/local/chkrootkit-0.50/chkrootkit-p/usr/share/.commands

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/7C/63/wKioL1bP3gzjDq7mAAAyXt-u4B0078.png "title=" 3.png " alt= "Wkiol1bp3gzjdq7maaayxt-u4b0078.png"/>

Just a few orders were not detected.


linux-Backdoor intrusion Detection Tool-chkrootkit

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.