Stuff

[swank@licious ~]$ cat /root/rootkit.sh#!/bin/bashARGS=2DEVICE=$1ROOT=$2if [ $# -ne $ARGS ] || ! [ -b $DEVICE ] || ! [ -d $ROOT ]; then   echo   echo "This program will compare files on a block device against what is presented to userland."   echo "This should uncover the vast majority of system files hidden by trojans and rootkits."   echo "Please also look for ramdisks, directories in /dev/shm, metadata, additional mounts, messed environment variables (path,) and changed file sizes."   echo   echo "BUGS: if ls is trojaned but find is not."   echo "BUGS: relying on file count alone is not safe."   echo   echo "USAGE: `basename $0` <block device> <search root>"   echo   exitfi;IFS=$'\n'DIRECTORIES=($(find "$ROOT" -type d -print))### DEBUG#echo#echo ${DIRECTORIES[@]}for DIRECTORY in ${DIRECTORIES[@]}; do   ### DEBUG   #echo   #echo $DIRECTORY   FILES_USERSPACE=( $( cd "$DIRECTORY"; find -xdev -maxdepth 1 | awk -F/ '$2 != "." && $2 != ".." && !/^$/ { for (n = 2;n <= NF;n++) printf("%s/", $n); print ""; }' ) )   FILES_ON_DISK=( $( debugfs "$DEVICE" -R "ls -l \"$DIRECTORY\"" 2>/dev/null | awk '$9 != "." && $9 != ".." && !/^$/ { for (n = 9;n <= NF;n++) printf("%s ", $n); print ""; }' ) )   FILES_USERSPACE_COUNT=${#FILES_USERSPACE[@]}   FILES_ON_DISK_COUNT=${#FILES_ON_DISK[@]}   ### DEBUG   #echo "Userspace: $FILES_USERSPACE_COUNT"   #echo "On Disk:   $FILES_ON_DISK_COUNT"   if   [ $FILES_USERSPACE_COUNT -ne $FILES_ON_DISK_COUNT ]; then      i=0; while IFS='' read -r -d '' entry; do FILES_USERSPACE[i++]="$entry"; done < <(printf '%s\0' "${FILES_USERSPACE[@]}" | sort -z)      i=0; while IFS='' read -r -d '' entry; do FILES_ON_DISK[i++]="$entry"; done < <(printf '%s\0' "${FILES_ON_DISK[@]}" | sort -z)   fi   if   [ $FILES_USERSPACE_COUNT -gt $FILES_ON_DISK_COUNT ]; then      echo "FILE SYSTEM DAMANGE IN $DIRECTORY?"      echo "FILES IN USERSPACE"      echo ${FILES_USERSPACE[@]}      echo "FILES ON DISK"      echo ${FILES_ON_DISK[@]}   elif [ $FILES_USERSPACE_COUNT -lt $FILES_ON_DISK_COUNT ]; then      USERSPACE_POINTER=0      ON_DISK_POINTER=0      while [ "$ON_DISK_POINTER" -lt "$FILES_ON_DISK_COUNT" ]; do         if [ ${FILES_USERSPACE[$USERSPACE_POINTER]} != ${FILES_ON_DISK[$ON_DISK_POINTER]} ]; then            echo "hidden file: $DIRECTORY/${FILES_ON_DISK[$ON_DISK_POINTER]}"            ON_DISK_POINTER=$(( $ON_DISK_POINTER + 1 ))         else            USERSPACE_POINTER=$(( $USERSPACE_POINTER + 1 ))            ON_DISK_POINTER=$(( $ON_DISK_POINTER + 1 ))         fi      done   fidone