Miscellany

[swank@licious src]$ cat /root/rootkit.sh#!/bin/bashNO_ARGS=0if [ $# -eq $NO_ARGS ] || ! [ -b $1 ] || ! [ -d $2 ]; then   echo   echo "This program will compare files on a block device against what is presented to userland."   echo "This should uncover the vast majority of system files hidden by trojans and rootkits."   echo "Please also look for ramdisks, directories in /dev/shm, metadata, additional mounts, messed environment variables (path,) and changed file sizes."   echo   echo "BUGS: if ls is trojaned but find is not."   echo   echo "USAGE: `basename $0` <block device> <search root>"   echo   exitfi;IFS=''DEVICE=$1ROOT=$2DIRECTORIES=`find $ROOT -type d`for DIRECTORY in ${DIRECTORIES[@]}; do   echo   echo $DIRECTORY   FILES_USERSPACE=( $( cd $DIRECTORY; find -xdev -maxdepth 1 -exec basename {} \; | grep -v "^.$" | grep -v "^..$" | grep -v "^$" | sort ) )   FILES_ON_DISK=( $( debugfs $DEVICE -R "ls -l $DIRECTORY" 2>/dev/null | awk -F: '{ print $2$3$4 }' | cut -b4- | grep -v '^.$' | grep -v '^..$' | grep -v '^$' | sort ) )   ### DEBUG   echo "Userspace: ${#FILES_USERSPACE[@]}"   echo "On Disk:   ${#FILES_ON_DISK[@]}"   if [ ${#FILES_USERSPACE[@]} -gt ${#FILES_ON_DISK[@]} ]; then      echo "FILE SYSTEM DAMANGE IN $DIRECTORY?"      echo "FILES IN USERSPACE"      echo ${FILES_USERSPACE[@]}      echo "FILES ON DISK"      echo ${FILES_ON_DISK[@]}   else      USERSPACE_POINTER=0      ON_DISK_POINTER=0      while [ $ON_DISK_POINTER -lt `echo "${#FILES_ON_DISK[@]} - 1" | bc` ]; do         if [ ${FILES_USERSPACE[$USERSPACE_POINTER]} != ${FILES_ON_DISK[$ON_DISK_POINTER]} ]; then            echo "hidden file: $DIRECTORY/${FILES_ON_DISK[$ON_DISK_POINTER]}"            ON_DISK_POINTER=`echo "$ON_DISK_POINTER + 1" | bc`         else            USERSPACE_POINTER=`echo "$USERSPACE_POINTER + 1" | bc`            ON_DISK_POINTER=`echo "$ON_DISK_POINTER + 1" | bc`         fi      done   fidone