Rootkit is a collection of malicious computer software designed to enable access to a computer that
is not otherwise allowed.
A rootkit contains malware that can steal data and take over a system for malicious purposes all while
remaining undetected.
Typically, a hacker installs the rootkit after having obtained privileged access to the system.
Obtaining this access is a result of a direct attack on the system, such as exploiting a known vulnerability
or getting a valid password obtained by cracking or social engineering tactics like phishing.
Once the rootkit is installed, it becomes possible to hide the intrusion as well as to maintain privileged
access.
A rootkit can hide the keylogger, capturing your keystrokes and sending your confidential information
to its master who controls it.
It can also allow hackers to use your computer for illicit activities, such as launching a denial of
service attack against other computers or sending out spam.
Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended
to find it.
Rootkits could remain in place for a very long time because their role is to hide any trail of their
existence.
So finding rootkits is a challenge, especially if it loads kernel modules and compromises.
The kernel by modifying kernel system calls.
Kernel good kicks can hide files, directories, processes or network connections without modifying
any system binaries.
I want you to remember something very important.
If the system was compromised by a rootkit and you find out about it by any means, you must reinstall
the entire system.
Never, but never trust a compromised machine.
Period.
Now that you know how dangerous a rootkit can be, let's go ahead and see how you can scan for rootkits
and malware on a Linux system.
We'll take a look at two security tools, a good kit hunter and check out Kit.
It's recommended to run these tools from a rescue disk.
Typically a live one or optionally, they can use an alternate directory from which to run all of their
own commands.
This way allows the rootkit scanner to trust the commands upon which they depend a bit more.
A good kit Hunter or Ark Hunter is a security monitoring tool for Linux, which scans for ROOTKITS and
other possible vulnerabilities.
It does so by searching for the default directories of rootkits misconfigured permissions, hidden files
kernel modules containing suspicious strings and comparing hashes of important files with known good
ones.
It is written in bash so it's portable and can be run on any Linux based systems.
Lexy stole Aki Hunter from the official Ubuntu repositories.
AP to install Erik Hunter.
Installing it.
After installing Arc Hunter and prior to running it for the first time, update the File Properties
database.
One of the checks Ark Hunter performs is to compare various current file properties of various commands
against those it has previously stored.
I'm running RJ Hunter minus minus.
Prop up the.
This comment causes Aki Hunter to update its data file of stored values with the current values.
Let's run a full system check aka Hunter.
Minus, minus check.
This comment performs various checks on the local system.
The result of each test will be displayed at the terminal, and if anything suspicious is found, then
a warning will be displayed.
A log file of the tests and the results will be automatically created in slash via slash log.
Let's take a look at the log file in another terminal.
I'm splitting the terminal in two and I'm connecting to the VP's again.
This is a new connection to the same server.
So tell minus f slash var log arc hunter dot look.
And we see there a lot of information.
All the tests it performs.
I am pressing enter to continue.
I'm waiting for it to finish.
And it's done.
There is only one wording that says that zero taxes is allowed.
If you want to print ad console, only the warnings, run it with the minus minus report warnings only
option like this.
Note that it still updates the log file along with all the checks it makes.
Out of the box.
A good kid Hunter will throw up some false warnings during the file properties checks.
This is because a few of the core utilities have been replaced by different scripts.
For example, on this Ubuntu VM, Eric Hunter reports this warning.
I know this is a false positive since I've just installed the system from a trustworthy source.
These warnings can be muted by whitelisting them in the AK hunter config file.
Here.
I'm writing script white list.
And the path to the binary that generated the warning.
Let's take a look at another tool called K Rootkit that locally checks for a ROOTKITS.
I'm installing it app to install c k rootkit.
And to start us can simply run as route see HK rootkit.
It's performing lots of tests, displaying the results on the screen.
Note that the warning doesn't necessarily mean that the system was compromised.
It's just a red flag that needs to be further investigated.
The first thing you should do is search on Google for check rootkit and the warning it has displayed.
We can also run it in quiet mode by using the minus Q option, and it will print out only the warnings
if there are any.
And it's recommended to frequently run a chronic job that scans for good kicks.
That's all about good kicks and good kid scanners.
Thank you.