{"id":19,"date":"2010-07-11T23:19:00","date_gmt":"2010-07-11T14:19:00","guid":{"rendered":"http:\/\/yokensaka.com\/centos\/?p=19"},"modified":"2014-07-19T20:06:44","modified_gmt":"2014-07-19T11:06:44","slug":"chkrootkit%e3%81%ae%e3%82%a2%e3%83%a9%e3%83%bc%e3%83%a0","status":"publish","type":"post","link":"https:\/\/yokensaka.com\/centos\/chkrootkit%e3%81%ae%e3%82%a2%e3%83%a9%e3%83%bc%e3%83%a0\/","title":{"rendered":"chkrootkit\u306e\u30a2\u30e9\u30fc\u30e0"},"content":{"rendered":"<p>\u5148\u65e5\u3001\u4ee5\u4e0b\u306e\u30e1\u30fc\u30eb\u304c\u6765\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002<br \/>\nChecking `bindshell&#8217;&#8230; INFECTED (PORTS:  1008)<br \/>\nbindshell\u304c\u4ed5\u639b\u3051\u3089\u308c\u305f\u306e\u304b\u3068\u601d\u3044\u3001\u8272\u3005\u8abf\u3079\u305f\u3089\u3001\u3069\u3046\u3082\u30dd\u30fc\u30c81008\u304crpc.statd\u306e\u30d7\u30ed\u30bb\u30b9\u306b\u3088\u3063\u3066\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u3001bindshell\u3067\u306f\u306a\u304b\u3063\u305f\u3088\u3046\u306a\u306e\u3067\u3001\u307e\u305a\u306f\u4e00\u5b89\u5fc3\u3002<\/p>\n<pre>\r\n\u30dd\u30fc\u30c81008\u304c\u4f7f\u3063\u3066\u308b\u30d7\u30ed\u30bb\u30b9\u3092\u78ba\u8a8d\r\n[root@server ~]# lsof -i:1008\r\nCOMMAND    PID    USER   FD   TYPE DEVICE SIZE NODE NAME\r\nrpc.statd 2098 rpcuser    7u  IPv4   5737       TCP *:1008 (LISTEN)\r\nrpc.statd\u304c\u3001rpcuser\u306b\u3088\u3063\u3066\u8d77\u52d5\u3057\u3066\u3044\u308b\u3002\r\n\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3057\u3066\u3042\u3063\u305fchkrootkit\u3067\u4f7f\u7528\u3059\u308b\u30b3\u30de\u30f3\u30c9\u7fa4\u4f7f\u3063\u3066\u518d\u691c\u67fb\u3092\u884c\u3046\u3053\u3068\u306b\u3002\r\n[root@server ~]# shutdown -r now\r\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30de\u30b7\u30f3\u306b\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3057\u3066\u3042\u3063\u305fchkrootkitcmd.zip\u3092\u3001\/home\/higo\/\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u3066\u304b\u3089\u4ee5\u4e0b\u306e\u4f5c\u696d\u3092\u884c\u3046\u3002\r\n[root@server ~]# cd \/home\/higo\/\r\n[root@server higo]# mv -v chkrootkitcmd.zip \/root\r\n`chkrootkitcmd.zip' -> `\/root\/chkrootkitcmd.zip'\r\n[root@server higo]# cd\r\n[root@server ~]# unzip chkrootkitcmd.zip\r\nArchive:  chkrootkitcmd.zip\r\ncreating: chkrootkitcmd\/\r\ninflating: chkrootkitcmd\/id\r\ninflating: chkrootkitcmd\/egrep\r\ninflating: chkrootkitcmd\/sed\r\ninflating: chkrootkitcmd\/netstat\r\ninflating: chkrootkitcmd\/echo\r\ninflating: chkrootkitcmd\/find\r\ninflating: chkrootkitcmd\/awk\r\ninflating: chkrootkitcmd\/head\r\ninflating: chkrootkitcmd\/strings\r\ninflating: chkrootkitcmd\/ps\r\ninflating: chkrootkitcmd\/uname\r\ninflating: chkrootkitcmd\/ls\r\ninflating: chkrootkitcmd\/cut\r\n[root@server ~]# ls -l .\/chkrootkitcmd\/\r\n\u5408\u8a08 1084\r\n-rwxr-xr-x 1 root root 320416  7\u6708 12 09:20 awk\r\n-rwxr-xr-x 1 root root  34408  7\u6708 12 09:20 cut\r\n-rwxr-xr-x 1 root root  19852  7\u6708 12 09:20 echo\r\n-rwxr-xr-x 1 root root  85060  7\u6708 12 09:20 egrep\r\n-rwxr-xr-x 1 root root 151244  7\u6708 12 09:20 find\r\n-rwxr-xr-x 1 root root  31660  7\u6708 12 09:20 head\r\n-rwxr-xr-x 1 root root  22600  7\u6708 12 09:20 id\r\n-rwxr-xr-x 1 root root  95116  7\u6708 12 09:20 ls\r\n-rwxr-xr-x 1 root root 121300  7\u6708 12 09:20 netstat\r\n-r-xr-xr-x 1 root root  79004  7\u6708 12 09:20 ps\r\n-rwxr-xr-x 1 root root  51764  7\u6708 12 09:20 sed\r\n-rwxr-xr-x 1 root root  25892  7\u6708 12 09:20 strings\r\n-rwxr-xr-x 1 root root  20024  7\u6708 12 09:20 uname\r\n\/root\/chkrootkitcmd\/\u306e\u5916\u90e8\u30b3\u30de\u30f3\u30c9\u3067\u3001chkrootkit\u3092\u5b9f\u884c\u3002\r\n[root@server ~]# which chkrootkit\r\n\/usr\/sbin\/chkrootkit\r\n[root@server ~]# chkrootkit -p \/root\/chkrootkitcmd\/\r\nINFECTED\u306f\u7121\u3044\u3088\u3046\u3060\u304c\u3001INFECTED\u306e\u307f\u8868\u793a\u3055\u305b\u3066\u307f\u308b\u3002\r\n[root@server ~]# chkrootkit -p \/root\/chkrootkitcmd\/ | grep INFECTED\r\nINFECTED\u306f\u7121\u304b\u3063\u305f\u3002\r\nrpc.statd\u306e\u5f85\u3061\u53d7\u3051\u30dd\u30fc\u30c8\u3092\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3002\r\n[root@server ~]# netstat -anp|grep rpc.statd\r\ntcp        0      0 0.0.0.0:1006                0.0.0.0:*                   LISTEN      2096\/rpc.statd\r\nudp        0      0 0.0.0.0:1000                0.0.0.0:*                               2096\/rpc.statd\r\nudp        0      0 0.0.0.0:1003                0.0.0.0:*                               2096\/rpc.statd\r\nunix  2      [ ]         DGRAM                    5427   2096\/rpc.statd\r\nrpc.statd\u304c\u4f7f\u3063\u3066\u305f1008\u306f\u3059\u3067\u306b\u9055\u3046\u3082\u306e\u306b\u306a\u3063\u3066\u308b\u3002\r\n\u30dd\u30fc\u30c81008\u756a\u306f\u3001\u3069\u306e\u30d7\u30ed\u30bb\u30b9\u3082\u4f7f\u7528\u3057\u3066\u306a\u3044\u3053\u3068\u3092\u78ba\u8a8d\u3002\r\n[root@server ~]# lsof -i:1008\r\n[root@server ~]#\r\n\u518d\u691c\u67fb\u3067\u4f7f\u3063\u305f\u30d5\u30a1\u30a4\u30eb\u7fa4\u3092\u524a\u9664\u3002\r\n[root@server ~]# rm -v -f -R .\/chkrootkitcmd\/\r\nremoved `.\/chkrootkitcmd\/\/id'\r\nremoved `.\/chkrootkitcmd\/\/egrep'\r\nremoved `.\/chkrootkitcmd\/\/sed'\r\nremoved `.\/chkrootkitcmd\/\/netstat'\r\nremoved `.\/chkrootkitcmd\/\/echo'\r\nremoved `.\/chkrootkitcmd\/\/find'\r\nremoved `.\/chkrootkitcmd\/\/awk'\r\nremoved `.\/chkrootkitcmd\/\/head'\r\nremoved `.\/chkrootkitcmd\/\/strings'\r\nremoved `.\/chkrootkitcmd\/\/ps'\r\nremoved `.\/chkrootkitcmd\/\/uname'\r\nremoved `.\/chkrootkitcmd\/\/ls'\r\nremoved `.\/chkrootkitcmd\/\/cut'\r\nremoved directory: `.\/chkrootkitcmd\/'\r\nzip\u30d5\u30a1\u30a4\u30eb\u3082\u524a\u9664\r\n[root@server ~]# rm -v chkrootkitcmd.zip\r\nrm: remove \u901a\u5e38\u30d5\u30a1\u30a4\u30eb `chkrootkitcmd.zip'? y\r\nremoved `chkrootkitcmd.zip'\r\n\u4ee5\u524d\u306e\u30b3\u30de\u30f3\u30c9\u3067chkrootkit\u3092\u5b9f\u884c\r\n[root@server ~]# chkrootkit | grep INFECTED\r\n[root@server ~]#\r\nrootkit\u306f\u691c\u51fa\u3055\u308c\u306a\u304b\u3063\u305f\u3002\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\u5148\u65e5\u3001\u4ee5\u4e0b\u306e\u30e1\u30fc\u30eb\u304c\u6765\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002 Checking `bindshell&#038; &hellip; <a href=\"https:\/\/yokensaka.com\/centos\/chkrootkit%e3%81%ae%e3%82%a2%e3%83%a9%e3%83%bc%e3%83%a0\/\">\u7d9a\u304d\u3092\u8aad\u3080 <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-19","post","type-post","status-publish","format-standard","hentry","category-rootkitchkrootkit"],"_links":{"self":[{"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/posts\/19","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/comments?post=19"}],"version-history":[{"count":1,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/posts\/19\/revisions"}],"predecessor-version":[{"id":222,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/posts\/19\/revisions\/222"}],"wp:attachment":[{"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/media?parent=19"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/categories?post=19"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yokensaka.com\/centos\/wp-json\/wp\/v2\/tags?post=19"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}