마인테크WIKI

문서의 이전 판입니다!

---

#!/bin/bash
echo "SHV Rootkit checker by alex [at] evilcoder.net"
if [ $# -ne 1 ]
then
        echo "This is a SHV5 rootkit remover"
        echo "This script is released as it is and i can't be held responsable for any damages"
        echo "This script has been tested on Debian , Ubuntu and CentOS servers "
        echo "You must agree with that"
        echo "Usage : $0 yes"
        exit 1
fi
if [ "$1" != "yes" ];
then
echo "You should agree"
exit 1
elif [ "$1" == "yes" ];
then
echo "Thanks"
fi
#checking Linux type
OS=`cat /etc/issue|cut -d " " -f 1 | head -1`
if [ -d "/usr/lib/libsh" ];
then
        echo "We have SHV rootkit"
else
        echo "You don't have shv5 installed"
        exit 1
fi
echo "System Check"
if [ "$OS" == "Debian" ];
then
        echo "We have Debian"
        echo "Removing immutable from infected files"
chattr -sia /bin/dir
chattr -sia /usr/bin/find
chattr -sia /sbin/ifconfig
chattr -sia /bin/ls
chattr -sia /usr/bin/lsof
chattr -sia /usr/bin/md5sum
chattr -sia /bin/netstat
chattr -sia /bin/ps
chattr -sia /usr/bin/pstree
chattr -sia /usr/bin/top
chattr -sia /lib/libsh.so
chattr -sia /usr/lib/libsh
chattr -sia /usr/lib/libsh/*
chattr -sia /etc/sh.conf
chattr -sia /sbin/ttymon
chattr -sia /sbin/ttyload
echo "Deleting rootkit folders"
rm -rf /lib/libsh.so
rm -rf /usr/lib/libsh/
rm -rf /etc/sh.conf
rm -rf /sbin/ttyload
rm -rf /sbin/ttymon
echo "Reinstall new files"
apt-get update >>/dev/null
apt-get -y install --reinstall coreutils binutils net-tools psmisc lsof procps findutils >>/dev/null
echo "Killing Rootkit"
killall -9 ttymon
echo "You should reboot to finish cleaning"
elif [ "$OS" == "Ubuntu" ];then
echo "We have Ubuntu"
echo "Removing immutable from Ubuntu known infected files"
chattr -sia /bin/dir
chattr -sia /usr/bin/find
chattr -sia /sbin/ifconfig
chattr -sia /bin/ls
chattr -sia /usr/bin/lsof
chattr -sia /usr/bin/md5sum
chattr -sia /bin/netstat
chattr -sia /bin/ps
chattr -sia /usr/bin/pstree
chattr -sia /usr/bin/top
chattr -sia /lib/libsh.so
chattr -sia /usr/lib/libsh
chattr -sia /usr/lib/libsh/*
chattr -sia /etc/sh.conf
chattr -sia /sbin/ttymon
chattr -sia /sbin/ttyload
echo "Deleting rootkit folders"
rm -rf /lib/libsh.so
rm -rf /usr/lib/libsh/
rm -rf /etc/sh.conf
rm -rf /sbin/ttyload
rm -rf /sbin/ttymon
echo "Reinstall new files"
apt-get update >>/dev/null
apt-get -y install --reinstall coreutils binutils net-tools psmisc lsof procps findutils >>/dev/null
echo "Killing Rootkit"
killall -9 ttymon
echo "You should reboot to finish cleaning"
elif [ "$OS" == "CentOS" ];then
echo "We got CentOS"
echo "Removing immutable flag from CentOS known infected files"
chattr -sia /usr/bin/dir
chattr -sia /usr/bin/find
chattr -sia /sbin/ifconfig
chattr -sia /bin/ls
chattr -sia /usr/sbin/lsof
chattr -sia /usr/bin/md5sum
chattr -sia /bin/netstat
chattr -sia /bin/ps
chattr -sia /usr/bin/pstree
chattr -sia /usr/bin/top
chattr -sia /lib/libsh.so
chattr -sia /usr/lib/libsh
chattr -sia /usr/lib/libsh/*
chattr -sia /etc/sh.conf
chattr -sia /sbin/ttymon
chattr -sia /sbin/ttyload
echo "Deleting rootkit folders"
rm -rf /lib/libsh.so
rm -rf /usr/lib/libsh/
rm -rf /etc/sh.conf
rm -rf /sbin/ttyload
rm -rf /sbin/ttymon
echo "Reinstall new files"
yum -y reinstall coreutils binutils net-tools psmisc lsof procps findutils >>/dev/null
echo "Killing Rootkit"
killall -9 ttymon
echo "You should reboot to finish cleaning"
fi
fi