The Rootkit Hunter
Learn how to install and set up Rootkit Hunter, a utility to stalk rootkits.
Thursday, September 15th, 2005
In an ideal world, all of your machines would be patched instantly with the latest, up-to-the-minute versions of all installed software, providing the best protection against exploits and vulnerabilities. Unfortunately, that’s rarely the case. And with experienced crackers and 0-day exploits prevalent and on the prowl, there is a constant threat of a compromise.
Of course, you should still do everything possible at every layer in your infrastructure to mitigate your risks. Be paranoid and assume the worst.
Rootkit Hunter, available from
http://www.rootkit.nl/, is a scanning tool that consists of one shell script, a few text-based databases, and optional
Perl modules. Written by Michael Boelen, it’s licensed under the
GPL. Rootkit Hunter scans files and systems for known and unknown rootkits, backdoors, and sniffers. It runs a variety of tests to look for default files used by rootkits (using an
MD5 hash compare that), incorrect file permissions for binaries, suspected strings in
Linux loadable kernel modules (and in
FreeBSD’s equivalent called
KLD modules), and hidden files.
Installation of Rootkit Hunter deviates from the standard ./configure&&make&&make install. After you download, verify, and unpack the source tarball, cd into the resulting directory and run:
$ sudo ./installer.sh
