Cyber Resistance

Information Security Blog

Detect Rootkits with rkhunter

What is a rootkit?
A rootkit is a program that runs on a *nix-based OSes, that allows a remote user to execute certain code or commands. There are many different types of rootkits. Some mount themselves among legit daemons and “hide” themselves often reporting results, output, or data to a remote server. Most rootkits I’ve seen aren’t destructive. They are malicious in nature because they use your server as zombie or bot. If you somehow encounter a really bad rootkit, it could allow a hacker remote access (ssh or telnet) with full root privledges. This is another reason to keep all your packages up2date.

What does rkhunter do?
Rkhunter is much like a virus scanner for a Windows system. It has definitions to help identify rootkits and reports them. Just like anything, rkhunter isn’t 100%, but it weeds out the majority of rootkits. Upon running rkhunter, various system files, conf files, and bin directories are examined. The results are cross-referenced against the results of infected systems (from the defintions) and the results are compiled. This is where *nix systems really shine. While your OS may vary, and how it’s compiled or configured, the file system and configuration is basically the same. This allows porgrams like rkhunter to provide results with a fairly small window for error or false positive.

Installing rkhunter
Just like all the other packages for *nix, you’ll have to download it’s tar file from their website. Sometimes I mirror packages on this site, but because this one changes often I’m not going to do that. You can find the latest version from the rkhunter websites (rootkit.nl). Obviously you have root privledges to install this. Here we go:
[root@roswell root]# wget www.orlandotechworks.com/rkhunter/rkhunter-1.2.8.tar.tar
–13:17:10–  http://www.orlandotechworks.com/rkhunter/rkhunter-1.2.8.tar.tar
=> `rkhunter-1.2.8.tar.tar’
Resolving www.orlandotechworks.com… 74.52.121.148
Connecting to www.orlandotechworks.com|74.52.121.148|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 126,314 (123K) [application/x-tar]

100%[================================================================================>] 126,314      259.19K/s

13:17:10 (258.38 KB/s) – `rkhunter-1.2.8.tar.tar’ saved [126314/126314]

[root@roswell root]# tar -xzvf rkhunter*.tar
./rkhunter/files/
./rkhunter/files/CHANGELOG
./rkhunter/files/LICENSE
./rkhunter/files/README
./rkhunter/files/WISHLIST
./rkhunter/files/backdoorports.dat
./rkhunter/files/check_modules.pl
./rkhunter/files/check_port.pl
./rkhunter/files/defaulthashes.dat
./rkhunter/files/filehashmd5.pl
./rkhunter/files/filehashsha1.pl
./rkhunter/files/mirrors.dat
./rkhunter/files/os.dat
./rkhunter/files/rkhunter
./rkhunter/files/rkhunter.conf
./rkhunter/files/rkhunter.spec
./rkhunter/files/showfiles.pl
./rkhunter/files/md5blacklist.dat
./rkhunter/files/tools/
./rkhunter/files/tools/update_server.sh
./rkhunter/files/tools/update_client.sh
./rkhunter/files/tools/README
./rkhunter/files/check_update.sh
./rkhunter/files/programs_bad.dat
./rkhunter/files/contrib/
./rkhunter/files/contrib/run_rkhunter.sh
./rkhunter/files/contrib/README.txt
./rkhunter/files/testing/
./rkhunter/files/testing/stringscanner.sh
./rkhunter/files/testing/rootkitinfo.txt
./rkhunter/files/testing/rkhunter.conf
./rkhunter/files/development/
./rkhunter/files/development/createfilehashes.pl
./rkhunter/files/development/createhashes.sh
./rkhunter/files/development/rpmhashes.sh
./rkhunter/files/development/rpmprelinkhashes.sh
./rkhunter/files/development/osinformation.sh
./rkhunter/files/development/rkhunter.8
./rkhunter/files/development/createhashesall.sh
./rkhunter/files/development/search_dead_sysmlinks.sh
./rkhunter/files/programs_good.dat
./rkhunter/installer.sh
[root@roswell root]# cd rkhunter
[root@roswell rkhunter]# ls
files  installer.sh
[root@roswell rkhunter]# ./installer.sh
Rootkit Hunter installer 1.2.4 (Copyright 2003-2005, Michael Boelen)
—————
Starting installation/update

Checking  /usr/local… OK
Checking file retrieval tools… /usr/bin/wget
Checking installation directories…
– Checking /usr/local/rkhunter…Created
– Checking /usr/local/rkhunter/etc…Created
– Checking /usr/local/rkhunter/bin…Created
– Checking /usr/local/rkhunter/lib/rkhunter/db…Created
– Checking /usr/local/rkhunter/lib/rkhunter/docs…Created
– Checking /usr/local/rkhunter/lib/rkhunter/scripts…Created
– Checking /usr/local/rkhunter/lib/rkhunter/tmp…Created
– Checking /usr/local/etc…Exists
– Checking /usr/local/bin…Exists
Checking system settings…
– Perl… OK
Installing files…
Installing Perl module checker… OK
Installing Database updater… OK
Installing Portscanner… OK
Installing MD5 Digest generator… OK
Installing SHA1 Digest generator… OK
Installing Directory viewer… OK
Installing Database Backdoor ports… OK
Installing Database Update mirrors… OK
Installing Database Operating Systems… OK
Installing Database Program versions… OK
Installing Database Program versions… OK
Installing Database Default file hashes… OK
Installing Database MD5 blacklisted files… OK
Installing Changelog… OK
Installing Readme and FAQ… OK
Installing Wishlist and TODO… OK
Installing RK Hunter configuration file… OK
Installing RK Hunter binary… OK
Configuration updated with installation path (/usr/local/rkhunter)

Installation ready.
See /usr/local/rkhunter/lib/rkhunter/docs for more information. Run ‘rkhunter’ (/usr/local/bin/rkhunter)

Running rkhunter
Well that’s it! As you can see I downloaded the package using wget, unpacked it, and installed it using a shell script. Now that it’s installed let’s run it! The results below are from a non-production RHEL3 box.
[root@roswell rkhunter]# rkhunter -c
Rootkit Hunter 1.2.8 is running

Results and Conclusion
Upon running the program, the results are compiled and displayed. They will be somewhat arbitrary because of different OSes, configurations and kernel builds. However, the action of detecting root kits and backdoors still works. As I mentioned above, this is a MUST if you adminster and *nix boxes that touch the internet. Rootkits are often the worst type of compromise possible. Most of them are designed to infect your OS, and do what it’s designed to do, with minimal detection. Don’t make the mistake of waiting to harden and audit your OS! You won’t enjoy the aftermath because you didn’t take the few hours to setup your precautionary methods before green lighting your production machines.

Leave a Reply

Your email address will not be published. Required fields are marked *

Cyber Resistance © 2017 Frontier Theme