#!/bin/sh

#################################################################################
#
#  Rootkit Hunter 
# ----------------
#
# Copyright Michael Boelen ( michael AT rootkit DOT nl )
# See LICENSE file for use of this software
#
#################################################################################

# Program information
PROGRAM_NAME="Rootkit Hunter"
PROGRAM_version="1.00 RC1"
PROGRAM_author="Michael Boelen"
PROGRAM_extrainfo=""

# Debugging
DEBUG=1

if [ "${DEBUG}" -eq 0 ]
  then
    # Through the drain...
    DEBUGFILE="/dev/null"
  else
    if [ -d "/var/log" ]
      then
        DEBUGFILE="/var/log/rkhunter.log"
      else
        DEBUGFILE="~/rkhunter.log"
    fi
fi

if [ "${DEBUGFILE}" = "" ]; then
  DEBUGFILE="/dev/null"
fi

INFECTED_COUNT=0
INFECTED_NAMES=""
SCANNED_COUNT=0
MD5_COUNT=0
MD5_DIFFERENT=0
# Skip MD5 check
MD5CHECK_SKIP=0

FOUNDFILE=0
FOUNDRCSIGNS=0
COLORS=1

# Warnings
WARNING=0
WAITONWARNING=1
PAUSEAFTERTESTS=0

# Integrity tests
STRINGSFAILED=0

if [ "${COLORS}" -eq 1 ]; then
  # Colors
  NORMAL="[0;39m" 
  warning="[33;55;1m" # yellow WARNING
  #YELLOW="[33;55;1m"
  YELLOW="[1;33m" # yellow
  WHITE="[1;37m"
  OK="[1;32m" # green OK
  DARKGRAY="[1;30m"
  green="[1;32m" # green
  red="[1;31m" # red
  BAD="[1;31m" # red BAD
fi

BEGINTIME=`date +%s`

filelist="/bin/ps /bin/ls"

# Messages
FOUNDTRACES="
             --------------------------------------------------------------------------------
	     Found parts of this rootkit/trojan by checking the default files and directories
	     Please inspect the available files, by running this check with the debug option.
	     --------------------------------------------------------------------------------
	     "

defaultcolumn="60"

arg1="$1"
arg2="$2"
arg3="$3"

STATUS="0"

# Almost every system has a root of '/', but just in case of..
ROOTDIR="/"
EGREP="egrep"

BINPATHS="/usr/sbin /usr/bin /usr/local/bin /usr/local/sbin"


##################################################################################################
#
# Global functions
#
##################################################################################################

    jump()
      {
        # jump to position 70
        counter=${SIZE}
      }

    waitkeypress()
      {
        if [ "${WAITONWARNING}" -eq 1 ]; then
	  echo ""
	  echo "[Press <ENTER> to continue]"
	  read a

	fi
      }

    debugdate()
      {
        sdate=`date "+[%H:%M:%S] "`
        echo -n "${sdate}"
      }


    keypresspause()
      {
        if [ "${PAUSEAFTERTESTS}" -eq 1 ]; then
	  echo "[Press <ENTER> to continue]"
	  read a

	fi
      }


    scanrootkit()
      {
        SCAN_STATUS=0
	JUMPCOL=`expr ${defaultcolumn} - 12`
	SIZE=`echo \'${SCAN_ROOTKIT}\' | wc -c | tr -s ' ' | tr -d ' '`
	jump=`expr ${JUMPCOL} - ${SIZE}`
	echo -n "   Rootkit '${SCAN_ROOTKIT}'... "
	debugdate >> ${DEBUGFILE}
	echo "*** Start scan ${SCAN_ROOTKIT} ***" >> ${DEBUGFILE}

        for I in $SCAN_FILES; do
	  debugdate >> ${DEBUGFILE}
	  echo -n "Scanning for file ${I}... " >> ${DEBUGFILE}
	  if [ -f ${I} ]; then
	      echo "WARNING! Exists." >> ${DEBUGFILE}        
	      SCAN_STATUS=1
	    else
	      echo "OK. Not found." >> ${DEBUGFILE}        
	  fi        
        
        done

	for I in $SCAN_DIRS; do
	  debugdate >> ${DEBUGFILE}
	  echo -n "Scanning for directory ${I}...               " >> ${DEBUGFILE}    
	  if [ -d ${I} ]; then
	      echo "WARNING! Exists." >> ${DEBUGFILE}        
	      SCAN_STATUS=1
	    else
	      echo "OK. Not found." >> ${DEBUGFILE}        
	  fi        
	done

        if [ "${SCAN_STATUS}" -eq 1 ]
	  then
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	    INFECTED_COUNT=`expr ${INFECTED_COUNT} + 1`
	    INFECTED_NAMES="${INFECTED_NAMES}${SCAN_ROOTKIT} "
	    echo "${FOUNDTRACES}"
	    
    	    # Run routine
	    waitkeypress

          else
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	fi
     }


# Applications
NMAPFOUND=0
PERLFOUND=0
WGETFOUND=0
MD5FOUND=0

for I in ${BINPATHS}; do
  J=${I}"/wget"    
    if [ -f ${J} ]; then
      WGETFOUND=1
      WGETBINARY=${J}
    fi

  J=${I}"/nmap"    
    if [ -f ${J} ]; then
      NMAPFOUND=1
      NMAPBINARY=${J}
    fi

  J=${I}"/perl"    
    if [ -f ${J} ]; then
      PERLFOUND=1
      PERLBINARY=${J}
      PERLVERSION=`${J} -V:version | tr -d "version" | tr -d '=' | tr -d "'" | tr -d ";" `
    fi

  J=${I}"/md5"    
    if [ -f ${J} ]; then
      MD5FOUND=1
      MD5BINARY=${J}
    fi

  J=${I}"/md5sum"    
    if [ -f ${J} ]; then
      MD5FOUND=1
      MD5BINARY=${J}
    fi

done

if [ ! "${MD5BINARY}" = "" ]
  then
    md5=${MD5BINARY}
fi


BACKDOORPORTS="2006"

# Default rootkit files

# 55808 Variant A
W55808A_FILES="${ROOTDIR}tmp/.../r ${ROOTDIR}tmp/.../a"

# Apache Worm
APACHEWORM_FILES="${ROOTDIR}bin/.log"

# Ambient (ark) Rootkit
ARK_FILES="${ROOTDIR}usr/lib/.ark?"
ARK_DIRS="${ROOTDIR}dev/ptyxx"

SHV4_FILES="${ROOTDIR}etc/ld.so.hash ${ROOTDIR}lib/libext-2.so.7 ${ROOTDIR}lib/lidps1.so ${ROOTDIR}usr/sbin/xntps"
SHV4_DIRS="${ROOTDIR}lib/security/.config ${ROOTDIR}lib/security/.config/ssh"

# Beastkit
BEASTKIT_FILES="${ROOTDIR}usr/sbin/arobia ${ROOTDIR}usr/sbin/idrun ${ROOTDIR}usr/lib/elm/arobia/elm ${ROOTDIR}usr/lib/elm/arobia/elm/hk ${ROOTDIR}usr/lib/elm/arobia/elm/hk.pub ${ROOTDIR}usr/lib/elm/arobia/elm/sc ${ROOTDIR}usr/lib/elm/arobia/elm/sd.pp ${ROOTDIR}usr/lib/elm/arobia/elm/sdco ${ROOTDIR}usr/lib/elm/arobia/elm/srsd ${ROOTDIR}lib/libproc.a ${ROOTDIR}lib/libproc.so.2.0.6 ${ROOTDIR}lib/lidps1.so ${ROOTDIR}usr/include/file.h ${ROOTDIR}usr/include/hosts.h ${ROOTDIR}usr/include/log.h ${ROOTDIR}usr/include/proc.h"
BEASTKIT_DIRS="${ROOTDIR}lib/ldd.so/bktools"

BOBKIT_FILES="
${ROOTDIR}usr/sbin/ntpsx
${ROOTDIR}usr/lib/.../ls
${ROOTDIR}usr/lib/.../netstat
${ROOTDIR}usr/lib/.../lsof
${ROOTDIR}usr/lib/.../bkit-ssh/bkit-shdcfg
${ROOTDIR}usr/lib/.../bkit-ssh/bkit-shhk
${ROOTDIR}usr/lib/.../bkit-ssh/bkit-pw
${ROOTDIR}usr/lib/.../bkit-ssh/bkit-shrs
${ROOTDIR}usr/lib/.../uconf.inv
${ROOTDIR}usr/lib/.../psr
${ROOTDIR}usr/lib/.../find
${ROOTDIR}usr/lib/.../pstree
${ROOTDIR}usr/lib/.../slocate
${ROOTDIR}usr/lib/.../du
${ROOTDIR}usr/lib/.../top
"

BOBKIT_DIRS="${ROOTDIR}usr/lib/... ${ROOTDIR}usr/lib/.../bkit-ssh"

# CiNIK Worm (Slapper.B variant)
CINIK_DIRS="${ROOTDIR}tmp/.font-unix/.cinik"
CINIK_FILES="${ROOTDIR}tmp/.cinik"

# Devil
DEVIL_FILES="
${ROOTDIR}var/lib/games/.src
${ROOTDIR}dev/dsx
${ROOTDIR}dev/caca
"

# Dica (T0rn variant)
DICA_FILES="${ROOTDIR}lib/.sso ${ROOTDIR}lib/.so"

# FreeBSD Rootkit
FREEBSD_RK_FILES="
${ROOTDIR}usr/lib/.fx/sched_host.2
${ROOTDIR}usr/lib/.fx/random_d.2
${ROOTDIR}usr/lib/.fx/set_pid.2
${ROOTDIR}usr/lib/.fx/cons.saver
${ROOTDIR}usr/lib/.fx/adore/adore/adore.ko
${ROOTDIR}bin/sysback
${ROOTDIR}usr/local/bin/sysback
"

FREEBSD_RK_DIRS="${ROOTDIR}usr/lib/.fx ${ROOTDIR}usr/lib/.fx/adore"

# Fuckit Rootkit
FUCKIT_FILES="
${ROOTDIR}dev/proc/fuckit/hax0r
${ROOTDIR}dev/proc/fuckit/hax0rshell
${ROOTDIR}dev/proc/fuckit/config/lports
${ROOTDIR}dev/proc/fuckit/config/rports
${ROOTDIR}dev/proc/fuckit/config/rkconf
${ROOTDIR}dev/proc/fuckit/config/password
${ROOTDIR}dev/proc/fuckit/config/progs
${ROOTDIR}dev/proc/system-bins/init
"

# GasKit Rootkit
GASKIT_FILES="${ROOTDIR}dev/dev/gaskit/sshd/sshdd"

GASKIT_DIRS="${ROOTDIR}dev/dev ${ROOTDIR}dev/dev/gaskit ${ROOTDIR}dev/dev/gaskit/sshd"

# ImperalsS-FBRK (FreeBSD Rootkit)
IMPFRB_DIRS="${ROOTDIR}dev/fd/.88 ${ROOTDIR}dev/fd/.99"

# Lion Worm
LION_FILES="
${ROOTDIR}bin/in.telnetd
${ROOTDIR}bin/mjy
${ROOTDIR}usr/man/man1/man1/lib/.lib/mjy
${ROOTDIR}usr/man/man1/man1/lib/.lib/in.telnetd
${ROOTDIR}usr/man/man1/man1/lib/.lib/.x
${ROOTDIR}dev/.lib/lib/scan/1i0n.sh
${ROOTDIR}dev/.lib/lib/scan/hack.sh
${ROOTDIR}dev/.lib/lib/scan/bind
${ROOTDIR}dev/.lib/lib/scan/randb
${ROOTDIR}dev/.lib/lib/scan/scan.sh
${ROOTDIR}dev/.lib/lib/scan/pscan
${ROOTDIR}dev/.lib/lib/scan/star.sh
${ROOTDIR}dev/.lib/lib/scan/bindx.sh
${ROOTDIR}dev/.lib/lib/scan/bindname.log
${ROOTDIR}dev/.lib/lib/1i0n.sh
${ROOTDIR}dev/.lib/lib/lib/netstat
${ROOTDIR}dev/.lib/lib/lib/dev/.1addr
${ROOTDIR}dev/.lib/lib/lib/dev/.1logz
${ROOTDIR}dev/.lib/lib/lib/dev/.1proc
${ROOTDIR}dev/.lib/lib/lib/dev/.1file
"

# MRK (MiCrobul RootKit?, based on Devil RootKit )
MRK_FILES="
${ROOTDIR}dev/ida/.inet/pid
${ROOTDIR}dev/ida/.inet/ssh_host_key
${ROOTDIR}dev/ida/.inet/ssh_random_seed
${ROOTDIR}dev/ida/.inet/tcp.log
"

MRK_DIRS="
${ROOTDIR}dev/ida/.inet
${ROOTDIR}var/spool/cron/.sh
"

# RootKit for SunOS / NSDAP
NSDAP_FILES="${ROOTDIR}usr/lib/vold/nsdap"

# Ohhara Rootkit
OHHARA_FILES="${ROOTDIR}var/lock/subsys/...datafile.../...datafile.../in.smbd.log"
OHHARA_DIRS="
${ROOTDIR}var/lock/subsys/...datafile...
${ROOTDIR}var/lock/subsys/...datafile.../...datafile...
${ROOTDIR}var/lock/subsys/...datafile.../...datafile.../bin
${ROOTDIR}var/lock/subsys/...datafile.../...datafile.../usr/bin
${ROOTDIR}var/lock/subsys/...datafile.../...datafile.../usr/sbin
${ROOTDIR}var/lock/subsys/...datafile.../...datafile.../lib/security
"

# Optic Kit (Tux)
OPTICKIT_DIRS="${ROOTDIR}dev/tux ${ROOTDIR}usr/bin/xchk ${ROOTDIR}usr/bin/xsf ${ROOTDIR}usr/bin/ssh2d"

# Oz Rootkit
OZ_FILES="${ROOTDIR}dev/.oz/.nap/rkit/terror"
OZ_DIRS="${ROOTDIR}dev/.oz"

PORTACELO_FILES="
/var/lib/.../.ak
/var/lib/.../.hk
/var/lib/.../.rs
/var/lib/.../.p
/var/lib/.../getty
/var/lib/.../lkt.o
/var/lib/.../show
/var/lib/.../nlkt.o
/var/lib/.../ssshrc
/var/lib/.../sssh_equiv
/var/lib/.../sssh_known_hosts
/var/lib/.../sssh_pid
~/.sssh/known_hosts
"

SHUTDOWN_DIRS="${ROOTDIR}usr/man/man5/..%%/.dir/scannah ${ROOTDIR}etc/rc.d/rc0.d/..%%/.dir"
SHUTDOWN_FILES="${ROOTDIR}usr/man/man5/..%%/.dir/scannah/asus ${ROOTDIR}usr/man/man5/..%%/.dir/see ${ROOTDIR}usr/man/man5/..%%/.dir/nscd ${ROOTDIR}usr/man/man5/..%%/.dir/alpd ${ROOTDIR}etc/rc.d/rc.local%%"

# Scalper (FreeBSD.Scalper.Worm)
SCALPER_FILES="${ROOTDIR}tmp/.a ${ROOTDIR}tmp/.uua"

# Sin Rootkit
SIN_FILES="
${ROOTDIR}dev/.haos/haos1/.f/Denyed
${ROOTDIR}dev/ttyoa
${ROOTDIR}dev/ttyof
${ROOTDIR}dev/ttyop
${ROOTDIR}dev/ttyos
${ROOTDIR}usr/lib/.lib 
${ROOTDIR}usr/lib/sn/.X
${ROOTDIR}usr/lib/sn/.sys
${ROOTDIR}usr/lib/ld/.X
${ROOTDIR}usr/man/man1/...
${ROOTDIR}usr/man/man1/.../.m
${ROOTDIR}usr/man/man1/.../.w
"

SIN_DIRS="${ROOTDIR}usr/lib/sn ${ROOTDIR}usr/lib/man1/... ${ROOTDIR}dev/.haos"

# Slapper
SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.uubugtraq ${ROOTDIR}tmp/.bugtraq.c ${ROOTDIR}tmp/httpd ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"

# SunOS Rootkit
SUNOSROOTKIT_FILES="
${ROOTDIR}etc/ld.so.hash
${ROOTDIR}lib/libext-2.so.7
${ROOTDIR}usr/bin/ssh2d
${ROOTDIR}bin/xlogin
${ROOTDIR}usr/lib/crth.o
${ROOTDIR}usr/lib/crtz.o
${ROOTDIR}sbin/login
${ROOTDIR}lib/security/.config/sn
${ROOTDIR}lib/security/.config/lpsched
${ROOTDIR}dev/kmod ${ROOTDIR}dev/dos
"

# Telnet Backdoor
TBD_FILES="
${ROOTDIR}usr/lib/.tbd
"

TORN_FILES="
${ROOTDIR}dev/.lib/lib/lib/t0rns
${ROOTDIR}dev/.lib/lib/lib/du
${ROOTDIR}dev/.lib/lib/lib/ls
${ROOTDIR}dev/.lib/lib/lib/t0rnsb
${ROOTDIR}dev/.lib/lib/lib/ps
${ROOTDIR}dev/.lib/lib/lib/t0rnp
${ROOTDIR}dev/.lib/lib/lib/find
${ROOTDIR}dev/.lib/lib/lib/ifconfig
${ROOTDIR}dev/.lib/lib/lib/pg
${ROOTDIR}dev/.lib/lib/lib/ssh.tgz
${ROOTDIR}dev/.lib/lib/lib/top
${ROOTDIR}dev/.lib/lib/lib/sz
${ROOTDIR}dev/.lib/lib/lib/login
${ROOTDIR}dev/.lib/lib/lib/in.fingerd
${ROOTDIR}dev/.lib/lib/lib/1i0n.sh
${ROOTDIR}dev/.lib/lib/lib/pstree
${ROOTDIR}dev/.lib/lib/lib/in.telnetd
${ROOTDIR}dev/.lib/lib/lib/mjy
${ROOTDIR}dev/.lib/lib/lib/sush
${ROOTDIR}dev/.lib/lib/lib/tfn
${ROOTDIR}dev/.lib/lib/lib/name
${ROOTDIR}dev/.lib/lib/lib/getip.sh
${ROOTDIR}usr/info/.torn/sh*
${ROOTDIR}usr/src/.puta/                                                                                      
${ROOTDIR}usr/src/.puta/.1addr
${ROOTDIR}usr/src/.puta/.1file
${ROOTDIR}usr/src/.puta/.1proc
${ROOTDIR}usr/src/.puta/.1logz
${ROOTDIR}usr/info/.t0rn/                  
"

TORN_DIRS="
${ROOTDIR}dev/.lib/
${ROOTDIR}dev/.lib/lib/
${ROOTDIR}dev/.lib/lib/lib/
${ROOTDIR}dev/.lib/lib/lib/dev/
${ROOTDIR}dev/.lib/lib/scan/
${ROOTDIR}usr/src/.puta/
${ROOTDIR}usr/man/man1/man1/
${ROOTDIR}usr/man/man1/man1/lib/
${ROOTDIR}usr/man/man1/man1/lib/.lib/
${ROOTDIR}usr/man/man1/man1/lib/.lib/.backup/
"

TPACK_FILES=""
TPACK_DIRS=""

# X-Org SunOS Rootkit
XORGSUNOS_FILES="
${ROOTDIR}usr/lib/libX.a/bin/tmpfl
${ROOTDIR}usr/lib/libX.a/bin/rps
${ROOTDIR}usr/bin/srload
${ROOTDIR}usr/lib/libX.a/bin/sparcv7/rps
${ROOTDIR}usr/sbin/modcheck
"

XORGSUNOS_DIRS="${ROOTDIR}usr/lib/libX.a
${ROOTDIR}usr/lib/libX.a/bin
${ROOTDIR}usr/lib/libX.a/bin/sparcv7"

# Miscellaneous login backdoors
LOGIN_BACKDOOR_FILES="${ROOTDIR}bin/.login"

# Misc Apache Backdoors
APACHEBDOORS_STRINGS="gotcha"

# Suspicious files in /dev
# v1rootkit does use some files here to hide processes, UIDs en GIDs.
# Files: /dev/ttyp, /dev/ttypr, /dev/ttypp, /dev/ttypq (Checked: FreeBSD and RedHat doesn't have this files by default)
# Files: /dev/ptyxx/.list /dev/ptyxx/.proc

SUSPICIOUS1_FILES="
${ROOTDIR}dev/ttyp
${ROOTDIR}dev/ttypr
${ROOTDIR}dev/ttypp
${ROOTDIR}dev/ttypq
${ROOTDIR}dev/ptyxx/.list
${ROOTDIR}dev/ptyxx/.proc
"

# /tmp/.X11-unix/.../rk (sneakin rootkit)
SUSPICIOUS1_DIRS="/tmp/.X11-unix/.../rk /usr/X11R6/bin/.,/copy/ /dev/rd"

# Evil strings
STRINGSCAN="
bin:init:/dev/proc/fuckit:Fuckit%%Rootkit
bin:login:vt200:Possible%%Linux%%Rootkit
bin:login:/usr/bin/xstat:Possible%%Linux%%Rootkit
bin:login:/bin/envpc:Unknown
bin:login:l4m3r0x:Unknown
bin:login:/usr/lib/.tbd:TBD%%Rootkit
bin:ls:/dev/ptyxx/.file:Dica%%(T0rn%%variant)
bin:ls:/dev/sgk:Unknown
bin:ls:/var/lock/subsys/...datafile...:Ohhara%%Rootkit
bin:ls:/usr/lib/.tbd:TBD%%Rootkit
bin:netstat:/dev/proc/fuckit:Fuckit%%Rootkit
bin:netstat:/lib/.sso:Dica%%(T0rn%%variant)
bin:netstat:/var/lock/subsys/...datafile...:Ohhara%%Rootkit
bin:netstat:/dev/caca:MRK
bin:netstat:/dev/ttyoa:Sin%%Rootkit
bin:nscd:sshd_config:Possible%%backdoor%%shell%%installed%%(SSH)
bin:ps:List%%of%%users%%must%%follow:Fuckit%%Rootkit
bin:ps:/dev/pts/01:SunOS%%Rootkit
bin:ps:tw33dl3:SunOS%%Rootkit
bin:ps:psniff:SunOS%%Rootkit
bin:ps:/var/lock/subsys/...datafile...:Ohhara%%Rootkit
bin:rpc.nfsd:cant%%open%%log:Possible%%sniffer%%installed
bin:rpc.nfsd:promiscuous:Possible%%sniffer%%installed
bin:rpc.nfsd:sniff.pid:Possible%%sniffer%%installed
bin:rpc.nfsd:tcp.log:Possible%%sniffer%%installed
bin:sshd:/dev/ptyxx:OpenBSD%%Rootkit
bin:syslogd:promiscuous:Possible%%sniffer%%installed
bin:syslogd:/usr/lib/.tbd:TBD%%Rootkit
bin:tcpd:/dev/xdta:Dica%%(T0rn%%variant)
bin:top:/usr/lib/.tbd:TBD%%Rootkit
bin:xtty:/bin/sh:Possible%%backdoor%%shell%%installed
etc:passwd:r00t:Possible%%GasKit
etc:passwd:t00r:Possible%%GasKit
libs:libproc.so.2.0.7:/dev/proc/fuckit:Fuckit%%Rootkit
"

# bin: /bin, /usr/bin, /usr/local/bin, /usr/sbin, /usr/local/sbin
# etc: /etc
# rc.d: /etc/rc.d
# rc.sysinit: /etc/rc.d

RCSTRINGS="
sshdu:Possible%%trojaned%%SSH%%Daemon
sshd1:Possible%%trojaned%%SSH%%Daemon
linsniffer:Possible%%keyboard%%sniffer%%found
startadore:Possible%%Adore%%rootkit%%found
ava:Possible%%PID%%hider%%found
.lsd:Torn%%based%%part%%found
/usr/bin/hdparm%%-t1%%-X53%%-p:MRK%%part%%found
"

BASHPROFILESTRINGS="
/dev/proc/fucking/config:Possible%%Rootkit%%found
/dev/proc/toolz/scan:Possible%%Rootkit%%found
/script:Possible%%background%%logger%%found
"

# Files
FILESCAN="
file:${ROOTDIR}dev/sdr0:Possible%%MD5%%hash%%database
file:${ROOTDIR}tmp/.syshackfile:Trojaned%%syslog%%daemon
file:${ROOTDIR}tmp/.bash_history:Possible%%Lite5-r%%rootkit
file:${ROOTDIR}usr/info/.clib:Possible%%backdoor
file:${ROOTDIR}usr/sbin/tcp.log:Possible%%sniffer
file:${ROOTDIR}usr/bin/take/pid:Trojaned%%SSH%%daemon
dir:${ROOTDIR}usr/bin/take:Trojaned%%SSH%%daemon
dir:${ROOTDIR}usr/src/.lib:Unusual%%directory
dir:${ROOTDIR}usr/share/man/man1/.1c:Possible%%Eggdrop%%installed
dir:${ROOTDIR}lib/lblip.tk:Directory%%with%%backdoored%%SSH-configuration
dir:${ROOTDIR}etc/.MG:Unusual%%directory(transformed%%Suckit%%rootkit)
"

# Integrity tests
STRINGS_INTEGRITY="${BOBKIT_FILES} ${BOBKIT_DIRS} ${CINIK_FILES} ${CINIK_DIRS} ${DICA_FILES} ${FREEBSD_RK_FILES}"

# Evil strings for *BSD KLD (Dynamic Kernel Linker modules)
KLDSTATKEYWORDS="backd00r backdoor"

# New:
#KLDSTATKEYWORDS="
#backd00r:Unknown%%backdoor
#backdoor:Unknown%%backdoor
#r00tkit:Unknown%%backdoor
#rootkit:Unknown%%backdoor
#darkside:Darkside%%KLD
#hide_link_file:Darkside%%KLD
#"

LKMSCAN="
LuCe%%LKM:LuCe%%LKM-module
"

RCLOCAL_STRINGS="
/usr/bin/rpc.wall:Unknown
sshdd:Possible%%GasKit
hidef:Possible%%part%%of%%Knark%%found
"

##################################################################################################
#
# Initialisation
#
##################################################################################################

    # Detect OS
    OPERATING_SYSTEM=`uname`

    # We don't know OS yet
    valid_os="0"

    # Clear screen for a clean start
    clear
      
      
# Begin parameters
      
case $1 in

##################################################################################################
#
# check complete system
#
##################################################################################################


  --checkall | -c )
    echo ""; echo ""; echo ""
    echo "${PROGRAM_NAME} ${PROGRAM_version} is running"
    echo ""
    
    echo -n "Determining OS..."
    
    if [ "${OPERATING_SYSTEM}" = "Linux" ]
      then
        # Ok, so this OS is one of the many Linux members :/
        valid_os="0"	

	# First we check it's the one with the red cap
	if [ -e "/etc/redhat-release" ]
	  then
	    # Yes, it's Redhat Linux. The name and version is there
	    full_osname=`cat /etc/redhat-release`
	    valid_os="1"
	    echo "Info: Found /etc/redhat-release" >> ${DEBUGFILE}
	fi

	# Debian?
	if [ -e "/etc/debian_version" ]
	  then
	    version=`cat /etc/debian_version`

	    uname_model=`uname -m`
	    case $uname_model in
		i[0-9]86) architecture=i386; ;;
		sun4u)    architecture=sparc64; ;;
		arm*)     architecture=arm; ;;
		ppc)      architecture=powerpc; ;;
	    esac

	    if [ "${version}" = "" ]; then
	        valid_os="0"
	      else
	        if [ "${architecture}" = "" ]; then
		    valid_os="0"
		  else
		    full_osname="Debian ${version} (${architecture})"
		    valid_os="1"
		fi
	    fi
	    
	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/debian_version" >> ${DEBUGFILE}
	fi

	# Mandrake?
	if [ -e "/etc/mandrake-release" ]
	  then
	    full_osname=`cat /etc/mandrake-release`
	    valid_os="1"
	    
	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/mandrake-release" >> ${DEBUGFILE}
	fi

	# SuSE?
	if [ -e "/etc/SuSE-release" ]
	  then
	    version=`cat /etc/SuSE-release | grep "SuSE Linux"`	  
	    full_osname="${version}"
	    valid_os="1"
	    
	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/SuSE-release" >> ${DEBUGFILE}
	fi

	# Turbo Linux?
	if [ -e "/etc/turbolinux-release" ]
	  then
	    full_osname=`cat /etc/turbolinux-release`
	    valid_os="1"

	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/turbolinux-release" >> ${DEBUGFILE}
	fi

	# Slackware?
	if [ -e "/etc/slackware-version" ]
	  then
	    full_osname=`cat /etc/slackware-version`
	    valid_os="1"

	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/slackware-version" >> ${DEBUGFILE}
	fi

	# Gentoo?
	if [ -e "/etc/gentoo-release" ]
	  then
	    full_osname=`cat /etc/gentoo-release`
	    valid_os="1"

	    debugdate >> ${DEBUGFILE}
	    echo "Info: Found /etc/gentoo-release" >> ${DEBUGFILE}
	fi


    fi

    
    if [ "${OPERATING_SYSTEM}" = "FreeBSD" ]
      then
        valid_os="1"
	version=`sysctl -n kern.osrelease | cut -d "-" -f 1`
	architecture=`sysctl -n hw.machine_arch`
	SUBVERSION=`sysctl -n kern.osrelease | cut -d "-" -f 2 | tr -d ' '`
	full_osname="FreeBSD ${version} (${architecture})"	
	
        debugdate >> ${DEBUGFILE}
	echo "Info: Found FreeBSD ${version}" >> ${DEBUGFILE}

	# Check FreeBSD version (release, stable, current)
        debugdate >> ${DEBUGFILE}
        if [ "${SUBVERSION}" = "RELEASE" ]
	  then
	    echo "Debug: You have a 'RELEASE' version of FreeBSD" >> ${DEBUGFILE}
	  else
	    echo "Debug: You have NOT a 'RELEASE' version of FreeBSD" >> ${DEBUGFILE}
	    MD5CHECK_SKIP=1
	fi

    fi

    if [ "${OPERATING_SYSTEM}" = "OpenBSD" ]
      then
        valid_os="1"
    fi

    if [ "${OPERATING_SYSTEM}" = "NetBSD" ]
      then
        valid_os="1"
    fi

    # Extract information from Operating System database
    os_string=`cat /usr/local/rkhunter/db/os.dat | grep "${full_osname}:"`
    os_id=`echo ${os_string} | cut -d ":" -f1`
    md5=`echo ${os_string} | cut -d ":" -f3`
    binroot=`echo ${os_string} | cut -d ":" -f4`
    
    if [ "${os_id}" = "" ]
      then
        valid_os="0"
    fi

    if [ ${valid_os} -eq "0" ]
      then
	echo "Warning: this operating system is not fully supported!"
        debugdate >> ${DEBUGFILE}
	echo "Warning: this operating system is not fully supported!" >> ${DEBUGFILE}
	os_id="NA"
	MD5CHECK_SKIP=1
      else
	echo " found ${full_osname}"  >> ${DEBUGFILE}
    fi

        debugdate >> ${DEBUGFILE}
        echo "Info: Using ${md5} to verify MD5 hashes" >> ${DEBUGFILE}

        debugdate >> ${DEBUGFILE}
	
	if [ -e `echo ${md5} | cut -d " " -f1 ` ]
	  then
	    echo "Info: ${md5} found" >> ${DEBUGFILE}
          else
            echo "Fatal error: Cannot find ${md5}"
	    exit
        fi

        debugdate >> ${DEBUGFILE}
	if [ -d "/usr/local/rkhunter/tmp" ]
	  then
	    echo "Info: /usr/local/rkhunter/tmp is present" >> ${DEBUGFILE}
	  else
	    echo "Info: /usr/local/rkhunter/tmp not present. Creating it." >> ${DEBUGFILE}
	    mkdir /usr/local/rkhunter/tmp
	fi

	if [ `id -u` = "0" ]
	  then
            debugdate >> ${DEBUGFILE}
	    echo "Info: UserID is zero (root)" >> ${DEBUGFILE}
	  else
	    echo "Fatal error: root rights needed to perform a full scan"
	    exit
	fi


        debugdate >> ${DEBUGFILE}
	if [ "${WGETFOUND}" -eq 1 ]
	  then
	    echo "Info: WGET found" >> ${DEBUGFILE}
	  else
	    echo "Info: WGET not found" >> ${DEBUGFILE}
	fi

        debugdate >> ${DEBUGFILE}
	if [ "${NMAPFOUND}" -eq 1 ]
	  then
	    echo "Info: NMAP found" >> ${DEBUGFILE}
	  else
	    echo "Info: NMAP not found" >> ${DEBUGFILE}
	fi

        debugdate >> ${DEBUGFILE}
	if [ "${PERLFOUND}" -eq 1 ]
	  then
	    echo "Info: Perl version ${PERLVERSION} found" >> ${DEBUGFILE}
	    
	    # Only use Perl MD5 module if we have it installed
	    # If we can find it then skip the md5(sum) utility
	    perlmd5installed=`/usr/local/rkhunter/scripts/check_modules.pl | grep 'Digest::MD5 installed'`
	    if [ ! "${perlmd5installed}" = "" ]
	      then
	        md5="/usr/local/rkhunter/scripts/filehashmd5.pl"
	        debugdate >> ${DEBUGFILE}
		echo "Info: ${perlmd5installed}" >> ${DEBUGFILE}
	    fi

	  else
	    echo "Info: Perl not found"
	fi


    echo ""; echo ""
    echo "${YELLOW}Checking binaries${NORMAL}"
    echo "${test}* Selftests${NORMAL}"    

    if [ "${DEBUG}" -eq 1 ]; then
	echo "------------------------------ Selftests ------------------------------" >> ${DEBUGFILE}
    fi

    # Self check
    
	
        MD5_SELF="041be5682f82122f93f73ae446d8fffd"
	
	cat ${0} | grep -v 'MD5_' > /tmp/md5hash
	MYHASH=`${md5} /tmp/md5hash`
	if [ -f /tmp/md5hash ]
	  then
	   rm /tmp/md5hash
	fi
	
	# Data definitions
	cat /usr/local/rkhunter/db/defaulthashes.dat | grep -v 'CRC' > /tmp/md5hash
	DEFHASHFILE=`${md5} /tmp/md5hash`
	if [ -f /tmp/md5hash ]
	  then
	   rm /tmp/md5hash
	fi
	MD5_DEFHASHFILE=`cat /usr/local/rkhunter/db/defaulthashes.dat | grep 'CRC' | cut -d ':' -f3`


	if [ "${DEBUG}" -eq 1 ]; then
	  echo "Perfoming check..." >> ${DEBUGFILE}
    	  echo "Expected file hash: ${MD5_SELF}" >> ${DEBUGFILE}
	  echo "Calculated file hash: ${MYHASH}" >> ${DEBUGFILE}
	fi

	SIZE=31
#	echo "   Performing consistency checks..."

#	echo -n "     ${PROGRAM_NAME} executable"
	if [ "${MYHASH}" = "${MD5_SELF}" ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
#	    echo -n "   ${file}"
#	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"

	    if [ "${DEBUG}" -eq 1 ]; then
    	      echo "Info: No differences found" >> ${DEBUGFILE}
	    fi

	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
#	    echo -n "   ${file}"
#	    echo -e "\033[${jump}C[ ${BAD}BAD${NORMAL} ]"
	    if [ "${DEBUG}" -eq 1 ]; then
    	      echo "Warning: Differences found!" >> ${DEBUGFILE}
	    fi
	fi

	SIZE=15
        jump=`expr ${defaultcolumn} - ${SIZE}`	
#	echo -n "     Hash file"
#	if [ "${DEFHASHFILE}" = "${MD5_DEFHASHFILE}" ]
#	  then
#	          echo -n "   ${file}"
#	          echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
#	  else
#	          echo -n "   ${file}"
#		  echo -e "\033[${jump}C[ ${BAD}BAD${NORMAL} ]"
#	fi


	SIZE=23
	echo -n "     Strings (command)"
	jump=`expr ${defaultcolumn} - ${SIZE}`
	STRINGSFAILED=0

	for I in ${STRINGS_INTEGRITY}; do
	  echo "${I}" > /tmp/stringstest.dat
	  STRINGFOUND=`strings /tmp/stringstest.dat | grep "${I}" | tr -d ' '`
	  if [ "${STRINGFOUND}" = "" ]
	    then
	      STRINGSFAILED=1
	      FAILEDSTRINGS="${FAILEDSTRINGS} ${I}"
	  fi
	done
	
	if [ "${STRINGSFAILED}" -eq 1 ]
	  then
	          echo -e "   ${file}\033[${jump}C[ ${BAD}BAD${NORMAL} ]"
		  echo ""
		  echo "-----------------------------------------------------------------------------------"
		  echo "Expected (but not found) strings:"
		  echo "${FAILEDSTRINGS}"
		  echo "-----------------------------------------------------------------------------------"
	  else
		  jump=`expr ${defaultcolumn} - ${SIZE}`
	          echo -e "   ${file}\033[${jump}C[ ${OK}OK${NORMAL} ]"
	fi
	echo "${NORMAL}"

	# Clean up temporary file
	rm -f /tmp/stringstest.dat
	
    echo ""

    # Binary check
    
    echo "${test}* System tools${NORMAL}"    

    if [ $MD5CHECK_SKIP -eq 0 ]
      then    

	for i in `cat /usr/local/rkhunter/db/defaulthashes.dat | grep "${os_id}:"`
	do
	  file=`echo ${i} | cut -d : -f 2`		
	  SIZE=`echo "${file}" | wc -c | tr -d ' '`	  
	  MD5_COUNT=`expr ${MD5_COUNT} + 1`
	  
	  if [ -e "${file}" ]
	    then
	      hash=`echo ${i} | cut -d : -f 3`	
	      myhash=`${md5} ${file} | cut -d " " -f 1`

	      echo -n "   ${file}"


	      if [ "${hash}" = "${myhash}" ]
		then
		  jump=`expr ${defaultcolumn} - ${SIZE}`
		  echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
		else
		  MD5_DIFFERENT=`expr ${MD5_DIFFERENT} + 1`
		  jump=`expr ${defaultcolumn} - ${SIZE}`
		  echo -e "\033[${jump}C[ ${BAD}BAD${NORMAL} ]"
		  WARNING=1
	      fi

	    else
	      jump=`expr ${defaultcolumn} - ${SIZE}`
	      echo -n "   ${file}"
	      echo -e "\033[${jump}C[ ${YELLOW}NA${NORMAL} ]"

	  fi
 
	done

	waitkeypress

      else
        echo "     ${WHITE}Skipped!${NORMAL}"
    fi	



##################################################################################################
#
# Rootkits
#
##################################################################################################


    WARNING=0
    echo ""; echo ""
    echo "${YELLOW}Check rootkits${NORMAL}"
    echo "${test}* Default files and directories${NORMAL}"

    # 55808 Trojan - Variant A

	SCAN_ROOTKIT="55808 Trojan - Variant A"
	SCAN_FILES=${W55808A_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Apache worm

	SCAN_ROOTKIT="Apache Worm"
	SCAN_FILES=${APACHEWORM_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Ambient (ark) Rootkit

	SCAN_ROOTKIT="Ambient (ark) Rootkit"
	SCAN_FILES=${ARK_FILES}
	SCAN_DIRS=${ARK_DIRS}
	scanrootkit

    # BeastKit

	SCAN_ROOTKIT="BeastKit"
	SCAN_FILES=${BEASTKIT_FILES}
	SCAN_DIRS=""
	scanrootkit

    # BOBKit

	SCAN_ROOTKIT="BOBKit"
	SCAN_FILES=${BOBKIT_FILES}
	SCAN_DIRS=""
	scanrootkit

    # CiNIK Worm (Slapper.B variant)
	SCAN_ROOTKIT="CiNIK Worm (Slapper.B variant)"
	SCAN_FILES=${CINIK_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Devil RootKit

	SCAN_ROOTKIT="Devil RootKit"
	SCAN_FILES=${DEVIL_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Dica

	SCAN_ROOTKIT="Dica"
	SCAN_FILES=${DICA_FILES}
	SCAN_DIRS=""
	scanrootkit

    # FreeBSD Rootkit

	SCAN_ROOTKIT="FreeBSD Rootkit"
	SCAN_FILES=${FREEBSD_RK_FILES}
	SCAN_DIRS=${FREEBSD_RK_DIRS}
	scanrootkit

    # Fuck`it Rootkit

	SCAN_ROOTKIT="Fuck\`it Rootkit"
	SCAN_FILES=${FUCKIT_FILES}
	SCAN_DIRS=""
	scanrootkit

    # GasKit

	SCAN_ROOTKIT="GasKit"
	SCAN_FILES=${GASKIT_FILES}
	SCAN_DIRS=${GASKIT_DIRS}
	scanrootkit

    # ImperalsS-FBRK

	SCAN_ROOTKIT="ImperalsS-FBRK"
	SCAN_FILES=""
	SCAN_DIRS=${IMPFRB_DIRS}
	scanrootkit

    # Li0n Worm

	SCAN_ROOTKIT="Li0n Worm"
	SCAN_FILES=${LION_FILES}
	SCAN_DIRS=""
	scanrootkit

    # MRK (MiCrobul RootKit?)

	SCAN_ROOTKIT="MRK"
	SCAN_FILES=${MRK_FILES}
	SCAN_DIRS=${MRK_DIRS}
	scanrootkit

    # RootKit for SunOS / NSDAP

	SCAN_ROOTKIT="RootKit for SunOS / NSDAP"
	SCAN_FILES=${NSDAP_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Optic Kit Worm

	SCAN_ROOTKIT="Optic Kit (Tux)"
	SCAN_FILES=""
	SCAN_DIRS=${OPTICKIT_DIRS}
	scanrootkit

    # Oz Rootkit

	SCAN_ROOTKIT="Oz Rootkit"
	SCAN_FILES=${OZ_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Portacelo

	SCAN_ROOTKIT="Portacelo"
	SCAN_FILES=${PORTACELO_FILES}
	SCAN_DIRS=""
	scanrootkit

    # Sebek LKM (Honeypot)

	STATUS=0
	SIZE=10

	if [ ${DEBUG} -eq 1 ]; then
	   echo "Debug: Sebek LKM" >> ${DEBUGFILE}
	fi
	echo -n "   Sebek LKM"

	if [ -r /proc/ksyms ]; then
	  if `${EGREP} -i adore < /proc/ksyms >/dev/null 2>&1`; then
	    STATUS=1
	  fi
        fi

	if [ ${STATUS} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	    echo "${FOUNDTRACES}"
	fi

    # Scalper Worm

	SCAN_ROOTKIT="Scalper Worm"
	SCAN_FILES=${SCALPER_FILES}
	SCAN_DIRS=""
	scanrootkit

    # SHV4 Rootkit

	SCAN_ROOTKIT="SHV4"
	SCAN_FILES=${SHV4_FILES}
	SCAN_DIRS=${SHV4_DIRS}
	scanrootkit

    # Slapper

	SCAN_ROOTKIT="Slapper"
	SCAN_FILES=${SLAPPER_FILES}
	SCAN_DIRS=""
	scanrootkit

    # SunOS Rootkit

	SCAN_ROOTKIT="SunOS Rootkit"
	SCAN_FILES=${SUNOSROOTKIT_FILES}
	SCAN_DIRS=${SUNOSROOTKIT_DIRS}
	scanrootkit

    # TBD (Telnet BackDoor)

	SCAN_ROOTKIT="TBD (Telnet BackDoor)"
	SCAN_FILES=${TBD_FILES}
	SCAN_DIRS=""
	scanrootkit

    # X-Org SunOS Rootkit

	SCAN_ROOTKIT="X-Org SunOS Rootkit"
	SCAN_FILES=${XORGSUNOS_FILES}
	SCAN_DIRS=${XORGSUNOS_DIRS}
	scanrootkit



##################################################################################################
#
# Malware
#
##################################################################################################

    echo ""
    echo "${test}* Suspicious files and malware${NORMAL}"

    SIZE=33
    echo -n "   Scanning for known rootkit files"

	for I in ${FILESCAN}; do
	  TYPE=`echo $I | cut -d ':' -f 1`
	  FILE=`echo $I | cut -d ':' -f 2`
	  INFO=`echo $I | cut -d ':' -f 3`
	  
	  FOUNDFILE=0
	  
	  FILE=`echo ${FILE} | sed 's/%%/ /g'`
	  INFO=`echo ${INFO} | sed 's/%%/ /g'`
	  
	  case ${TYPE} in
	    dir)
	      if [ -d "${FILE}" ]; then
		FOUNDFILE=1
	      fi
	      ;;
	    file)
	      if [ -f "{$FILE}" ]; then
		FOUNDFILE=1
	      fi
	      ;;
	  esac
	    
	done

	if [ ${FOUNDFILE} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    INFECTED_COUNT=`expr ${INFECTED_COUNT} + 1`
	    INFECTED_NAMES="${INFECTED_NAMES} / ${INFO} "

	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
            echo "
            -------------------------------------------------------------------------
	    Warning found file '${FILE}'
	    Information: ${INFO}
	    -------------------------------------------------------------------------
	    "

	fi
	  

    # Miscellaneous Login backdoors

	STATUS=0
	SIZE=30
	
	echo -n "   Miscellaneous Login backdoors"

	for I in ${LOGIN_BACKDOORS_FILES}
	  do
            if [ -d ${I} ]; then
              STATUS=1
	      if [ ${DEBUG} -eq 1 ]; then
              echo "${I} found! Possible part of a rootkit/trojan." >> ${DEBUGFILE}
	      fi
            fi
	    if [ ${DEBUG} -eq 1 ]; then
              echo "${I} clean" >> ${DEBUGFILE}
	    fi
          done

	if [ ${STATUS} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	fi

	STATUS=0
	SIZE=28
	
	echo -n "   Miscellaneous files in /dev"

	for I in ${SUSPICIOUS1_FILES}
	  do
            if [ -d ${I} ]; then
              STATUS=1
	      if [ ${DEBUG} -eq 1 ]; then
              echo "${I} found! Possible part of a rootkit/trojan." >> ${DEBUGFILE}
	      fi
            fi
	    if [ ${DEBUG} -eq 1 ]; then
              echo "${I} clean" >> ${DEBUGFILE}
	    fi
          done

	if [ ${STATUS} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	fi

	STATUS=0
	SIZE=26
	
	echo -n "   Miscellaneous directories"

	for I in ${SUSPICIOUS1_DIRS}; do
            if [ -f ${I} ]; then
              STATUS=1
	      if [ ${DEBUG} -eq 1 ]; then
              echo "${I} found! Possible part of a rootkit/trojan." >> ${DEBUGFILE}
	      fi
	     else
	      if [ ${DEBUG} -eq 1 ]; then
    	        echo -n "${I} " >> ${DEBUGFILE}
	        echo -e "[ ${OK}Not found${NORMAL} ]" >> ${DEBUGFILE}
	      fi
            fi
          done
	if [ ${STATUS} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	fi



waitkeypress



    echo ""
    echo "${test}* Trojan specific characteristics${NORMAL}"

    echo "   shv4"
    
    SIZE="32"
    jump=`expr ${defaultcolumn} - ${SIZE}`
    echo "     Checking /etc/rc.d/rc.sysinit"
    if [ -f /etc/rc.d/rc.sysinit ]
      then
        SIZE="11"
        jump=`expr ${defaultcolumn} - ${SIZE}`

        echo -n "       Test 1"
        if [ "`grep 'in.inetd' /etc/rc.d/rc.sysinit`" ]; then
	   echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	  else
	   echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	fi

        echo -n "       Test 2"
        if [ "`grep 'bin/xchk' /etc/rc.d/rc.sysinit`" ]; then
	   echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (possible Optic Kit / Tuxkit) ]"
	  else
	   echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	fi

        echo -n "       Test 3"
        if [ "`grep 'bin/xsf' /etc/rc.d/rc.sysinit`" ]; then
	   echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (possible Optic Kit / Tuxkit) ]"
	  else
	   echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	fi

       else
	echo -e "\033[${jump}C[ ${OK}Not found${NORMAL} ]"
    fi

    SIZE="27"
    jump=`expr ${defaultcolumn} - ${SIZE}`
    echo -n "     Checking /etc/inetd.conf"

    if [ -f /etc/inetd.conf ]
      then
        if [ "`grep in.cfinger /etc/inetd.conf`" ]; then
	   echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	  else
	   echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	fi
       else
	echo -e "\033[${jump}C[ ${OK}Not found${NORMAL} ]"
    fi

    echo ""
    echo "${test}* Suspicious file properties${NORMAL}"

    echo "   ${WHITE}chmod properties${NORMAL}"
    
    FILES="/bin/ps /bin/ls /usr/bin/w /usr/bin/who /bin/netstat /usr/bin/netstat /bin/login"
    for I in ${FILES}; do

       # Calculate string length
	SIZE=`echo "${I}" | wc -c | tr -d ' '`
	SIZE=`expr ${SIZE} + 11`	  
	jump=`expr ${defaultcolumn} - ${SIZE}`
	echo -n "     Checking ${I}"
	if [ -f ${I} ]; then
    	    RIGHTS=`ls -l ${I} | cut -c 1-10`
	    if [ "${RIGHTS}" = "-rwxrwxrwx" ]; then
		echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (chmod 777 found, possible trojaned) ]"
	      else
		echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	    fi
          else
	    echo -e "\033[${jump}C[ ${OK}Not found${NORMAL} ]"
	fi

    done

    echo "   ${WHITE}Script replacements${NORMAL}"

    for I in ${FILES}; do

       # Calculate string length
	SIZE=`echo "${I}" | wc -c | tr -d ' '`
	SIZE=`expr ${SIZE} + 11`	  
	jump=`expr ${defaultcolumn} - ${SIZE}`
	echo -n "     Checking ${I}"
	if [ -f ${I} ]
          then
	    if [ "`file -b {$I}`" = "Bourne shell script text executable" ]
	      then
		echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (script replacement found, possible trojaned) ]"
	      else
		echo -e "\033[${jump}C[ ${OK}Clean${NORMAL} ]"
	    fi
          else
	    echo -e "\033[${jump}C[ ${OK}Not found${NORMAL} ]"
	fi
    done


    echo ""
    echo "${test}* OS dependant tests${NORMAL}"
	if [ "${OPERATING_SYSTEM}" = "FreeBSD" ]
          then
    	    echo "   ${WHITE}FreeBSD${NORMAL}"
	    SIZE=38
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -n "     Checking presence of KLD signatures"
	    STATUS=0
	
	    for I in ${KLDSTATKEYWORDS}; do
	      PRESENCE=`kldstat -v | grep ${I}`
	      if [ ! "${PRESENCE}" = "" ]; then
		STATUS=1
		FOUNDKEYS="${FOUNDKEYS}${I} "
	      fi
	    done

	    if [ "${STATUS}" -eq 1 ]
	    then
	        echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (found terms: ${FOUNDKEYS}) ]"
	    else
		echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	    fi

	    SIZE=40
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    
	    echo -n "     Comparing output sockstat and netstat"
	    SOCKSTAT=`sockstat | grep '*:*' | cut -c 1-55 | grep '*:' | cut -c 39-47 | tr -d ' ' | sort | uniq`
	    NETSTAT=`netstat -an | grep -v 'TIME_WAIT' | grep -v 'ESTABLISHED' | grep -v 'SYN_SENT' | grep -v 'CLOSE_WAIT' | grep -v 'LAST_ACK' | grep -v 'SYN_RECV' | grep -v 'CLOSING' | cut -c 1-44 | grep '*.' | cut -c 24-32 | tr -d ' ' | tr -d '\t' | sort | uniq`

	    if [ "${SOCKSTAT}" = "${NETSTAT}" ]; then
	        echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	      else
	        echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (use expertmode to analyze) ]"
	    fi
	    
	    SIZE=38
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -n "     Scanning for promiscuous interfaces"	    
	    PROMISCSCAN=`ifconfig | grep 'PROMISC'`
	    if [ "${PROMISCSCAN}" = "" ]; then
	        echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	      else
	        echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (found promiscuous interface) ]"
	    fi

#	    KLDLOADS=`grep -r 'kldload' /etc/*`
#	    for I in "${KLDLOADS}"; do
#	      echo "${I}"
#	    done


	fi


	if [ ${OPERATING_SYSTEM} = "Linux" ]
	  then
	    echo ""
    	    echo "   ${WHITE}Linux${NORMAL}"
	    echo -n "   Checking loaded kernel modules... "

	    # show information found in /proc/modules (Linux-only) and get rid of the spaces
	    temp1=`cat /proc/modules | tr -d " "`
	    
	    # show output from lsmod. Throw away spaces, because they don't match the content
	    # of /proc/modules
	    temp2=`lsmod | grep -v "Size  Used by" | tr -d " "`

	    if [ "${temp1}" = "${temp2}" ]
	      then
	        echo "${OK}OK. ${NORMAL}"
	      else
	        echo "${BAD}Check failed ${NORMAL}found difference in output."
	    fi
	fi

	echo ""; echo ""
	echo "${YELLOW}Checking network connections${NORMAL}"

	echo "${test}* Check: frequently used backdoors${NORMAL}"

	if [ "${OPERATING_SYSTEM}" = "Linux" ]; then
	    donetstat="1"
	fi
	if [ "${OPERATING_SYSTEM}" = "FreeBSD" ]; then
	    donetstat="1"
	fi

	if [ "${donetstat}" = "1" ]
	  then
	    for i in `cat /usr/local/rkhunter/db/backdoorports.dat`
	      do
	        port=`echo ${i} | cut -d ':' -f 1`
		DESCRIPTION=`echo ${i} | cut -d ':' -f 2`
		DESCRIPTION=`echo ${DESCRIPTION} | sed 's/%%/ /g'`

		if [ "${OPERATING_SYSTEM}" = "Linux" ]
	          then
	    	    checkport=`netstat -an | grep ":${port}"`
	    	    donetstat="1"
		fi
	  
	        if [ "${OPERATING_SYSTEM}" = "FreeBSD" ]
		  then
	            checkport=`netstat -an | grep ".${port}"`
	        fi

		SIZE=`echo "   ${port}: ${DESCRIPTION} " | wc -c | tr -d ' '`	  
		jump=`expr ${defaultcolumn} - ${SIZE}`			
		echo -n "  Port ${port}: ${DESCRIPTION}"
		if [ "${checkport}" = "" ]
		  then
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
		  else
		    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (possible trojan port) ]"
		fi
 	      done
	  else
	    echo "${YELLOW}Not tested"
	fi  
	
    
waitkeypress


##################################################################################################
#
# System checks
#
##################################################################################################
	    

	echo ""; echo ""
	echo "${YELLOW}System checks${NORMAL}"

	echo "${test}* Allround tests${NORMAL}"

	    echo -n "   Checking hostname... "
	    hostname=`hostname`
	    if [ "${hostname}" = "" ]
	      then
	        echo "${BAD}Warning. ${NORMAL}Found empty hostname. Some programs don't like this."
	      else
	        echo "${OK}Found. ${NORMAL}Hostname is ${hostname}"
	    fi

	    echo -n "   Checking for differences in user accounts... "
	    if [ -e "/etc/passwd" ]
	      then
	        if [ -e "/usr/local/rkhunter/tmp/passwd" ]
		  then
		    differences=`diff /etc/passwd /usr/local/rkhunter/tmp/passwd | grep ":"`
		    if [ "${differences}" = "" ]
		      then
		        echo "${OK}OK. ${NORMAL}No changes."
		      else
			diffadded=`echo "${differences}" | grep "<"`
			diffremoved=`echo "${differences}" | grep ">"`
		        echo "${red}Found differences${NORMAL}"
		        echo "   Info: "
			echo "----------------------"
			echo "${differences}"
			echo "----------------------"
			if [ ! "${diffadded}" = "" ]
			  then
			    echo "   Info: Some items have been added (items marked with '<')"
			fi

			if [ ! "${diffremoved}" = "" ]
			  then
			    echo "   Info: Some items have been removed (items marked with '>')"
			fi
		    fi  
		    rm -f /usr/local/rkhunter/passwd
		  else
		    jump=44
		    echo -e "[ ${warning}NA${NORMAL} ]"

		fi

		cp /etc/passwd /usr/local/rkhunter/tmp/passwd
	      else
	        echo "${BAD}Error. ${NORMAL}Cannot find /etc/passwd"
	    fi


	    echo -n "   Checking for differences in user groups... "
	    if [ -e "/etc/group" ]
	      then
	        if [ -e "/usr/local/rkhunter/tmp/group" ]
		  then
		    differences=`diff /etc/group /usr/local/rkhunter/tmp/group | grep ":"`
		    if [ "${differences}" = "" ]
		      then
		        echo "${OK}OK. ${NORMAL}No changes."
		      else
			diffadded=`echo "${differences}" | grep ">"`
			diffremoved=`echo "${differences}" | grep "<"`
		        echo "${red}Found differences${NORMAL}"
		        echo "   Info: "
			echo "----------------------"
			echo "${differences}"
			echo "----------------------"
			if [ ! "${diffadded}" = "" ]
			  then
			    echo "   Info: Some items have been added (items marked with '>')"
			fi

			if [ ! "${diffremoved}" = "" ]
			  then
			    echo "   Info: Some items have been removed (items marked with '<')"
			fi
		    fi  
		    rm -f /usr/local/rkhunter/tmp/group
		  else
		    echo "${warning}Creating file ${NORMAL}It seems this is your first time."
		fi

		cp /etc/group /usr/local/rkhunter/tmp/group
	      else
	        echo "${BAD}Error. ${NORMAL}Cannot find /etc/group"
	    fi


	SIZE=31
	jump=`expr ${defaultcolumn} - ${SIZE}`
	echo "   Checking rc.local file... "
	
	RCLOCATIONS="/etc /etc/rc.d /usr/local/etc /usr/local/etc/rc.d"
	FOUNDRCSIGN=0

	for I in ${RCLOCATIONS}; do
	    FILE="${I}/rc.local"
	    FILELENGTH=`echo ${FILE} | wc -c | tr -d ' '`
	    SIZE=4
	    jump=`expr ${defaultcolumn} - ${SIZE} - ${FILELENGTH}`

	    echo -n "     - ${FILE}"
	    if [ -f "${FILE}" ]; then
		for J in ${RCLOCAL_STRINGS}; do
		  STRING=`echo ${J} | cut -d':' -f1`
		  FOUND=`cat ${FILE} | grep "${STRING}"`
		  if [ ! "${FOUND}" = "" ]
		    then
		      FOUNDRCSIGN=1
		  fi
	        done
		
		if [ "${FOUNDRCSIGN}" -eq 1 ]; then
		    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (found unusual signs) ]"
		  else
	            echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
		fi

	      else
	        echo -e "\033[${jump}C[ ${OK}Not found${NORMAL} ]"
	   fi
	done

	FOUNDRCSIGN=0
	SIZE=24
	COUNTER=0
	jump=`expr ${defaultcolumn} - ${SIZE}`
	echo "   Checking rc.d files... "
	echo -n "     Processing"

	for I in `find /etc/rc.d/*`; do
	
	  # Only check files, not directories
	  if [ -f ${I} ]
	    then
    	      COUNTER=`expr ${COUNTER} + 1`
	      if [ ${COUNTER} -eq 40 ]; then
	        echo "."
	        echo -n "               "
	        COUNTER=0
	      else
	        echo -n "."
	    fi
	    for J in ${RCLOCAL_STRINGS}; do
	      STRING=`echo ${J} | cut -d':' -f1`
	      FOUND=`cat ${I} | grep "${STRING}"`
	      if [ ! "${FOUND}" = "" ]
	        then
	          FOUNDRCSIGN=1
	      fi
	    done
	  fi	
	  
	done

	if [ "${FOUNDRCSIGN}" -eq 1 ]; then
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (found unusual signs) ]"
	  else
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	fi

	echo "   Checking history files"

	SIZE=15
	jump=`expr ${defaultcolumn} - ${SIZE}`			

	echo -n "     Bourne Shell"
	
	if [ -f /root/.bash_history ]
	  then
	    ATTRIBUTE=`ls -l /root/.bash_history | cut -c1`
	    if [ "${ATTRIBUTE}" = "l" ]
	      then
		echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (redirection found) ]"
	      else
		echo -e "\033[${jump}C[ ${OK}Not Found${NORMAL} ]"	    
	    fi	      
	  else
	    echo -e "\033[${jump}C[ ${OK}Not Found${NORMAL} ]"	    
	fi    

	echo ""
	echo "${test}* Filesystem checks${NORMAL}"
	echo -n "   Checking /dev for suspicious files... "
	    
	if [ -d ${ROOTDIR}dev ]; then
	
	  # FreeBSD (5): character special, symbolic link to,directory
	  # Linux (Debian): block special, socket, fifo (named pipe)
	  SPECIALFILES=`file ${ROOTDIR}dev/* | grep -v 'character special' | grep -v 'block special' | grep -v 'socket' | grep -v 'fifo (named pipe)' | grep -v 'symbolic link to' | grep -v 'directory'`
	  SPECIALFILES=`echo ${SPECIALFILES} | grep -v 'MAKEDEV'`
	  
	  SIZE=39
	  jump=`expr ${defaultcolumn} - ${SIZE}`			
	  
	  if [ "${SPECIALFILES}" = "" ]; then
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	   else
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (unusual files found) ]"
	    echo "---------------------------------------------"
	    echo "Unusual files:"
	    echo "${SPECIALFILES}"
	    echo "---------------------------------------------"
	  fi
         else
	    echo -e "\033[${jump}C[ ${YELLOW}NA${NORMAL} ]"	  
	fi   

	SIZE=29
	
	echo -n "   Scanning for hidden files..."

	SEARCHINDIRS="/dev /bin /usr/man /usr/man/man1 /dev"

	for I in ${SEARCHINDIRS}; do
	  # Initialize directory
	  STATUS=0
	  HIDDENDIRS=""
	  
	  debugdate >> ${DEBUGFILE}
	  echo "Start scanning for hidden files in ${I}..." >> ${DEBUGFILE}

	  if [ -d "${I}" ]; then
	    HIDDENDIRS=`/usr/local/rkhunter/scripts/showfiles.pl ${I}`
	  fi
	
	  if [ ! "${HIDDENDIRS}" = "" ]; then
	    ALLHIDDENDIRS="${ALLHIDDENDIRS} $HIDDENDIRS (in ${I})"
            STATUS=1
	    debugdate >> ${DEBUGFILE}
   	  fi

	  debugdate >> ${DEBUGFILE}
	  echo "End of scanning ${I}" >> ${DEBUGFILE}
  
	done

	if [ ${STATUS} -eq 0 ]
	  then
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"
	  else
	    jump=`expr ${defaultcolumn} - ${SIZE}`
	    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} ]"
	    echo "WARNING, found: ${ALLHIDDENDIRS}" >> ${DEBUGFILE}

    	    echo "---------------"
	    echo ${ALLHIDDENDIRS}
	    echo "---------------"

	fi


waitkeypress


##################################################################################################
#
# Security advisories
#
##################################################################################################

	echo ""; echo ""
	echo "${YELLOW}Security advisories${NORMAL}"

	SIZE=29
	jump=`expr ${defaultcolumn} - ${SIZE}`			


	    echo "${test}* Check: Groups and Accounts${NORMAL}"
	    echo -n "   Searching for /etc/group... "
	    if [ -e "/etc/group" ]
	      then
		echo -e "\033[${jump}C[ ${OK}Found${NORMAL} ]"	    
    	        echo -n "   Checking users in group '0' (root)... "


		SIZE=39
		jump=`expr ${defaultcolumn} - ${SIZE}`			

		    users_in_group_zero=`cat /etc/group | grep ":0:" | cut -d ":" -f4`
		    if [ "${users_in_group_zero}" = "root" ] 
		      then
			echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"	    
		      else
			echo -e "\033[${jump}C[ ${YELLOW}Warning!${NORMAL} (some users in root group) ]"
			echo "    info: ${users_in_group_zero}"
		    fi
	    
	      else
		echo -e "\033[${jump}C[ ${BAD}Not Found${NORMAL} ]"	    
	    fi	



	    echo "";
	    echo "${test}* Check: SSH${NORMAL}"


	    SIZE=39
	    jump=`expr ${defaultcolumn} - ${SIZE}`			
	
	    echo -n "   Searching for /etc/ssh/sshd_config... "
	    if [ -e "/etc/ssh/sshd_config" ]	
	      then
		echo -e "\033[${jump}C[ ${OK}Found${NORMAL} ]"	    

		echo -n "   Checking for allowed root login... "
		permitrootlogin=`cat /etc/ssh/sshd_config | grep "PermitRootLogin yes" | grep -v "#"`
		if [ "${permitrootlogin}" = "PermitRootLogin yes" ]
	          then
		    echo "${red}Watch out ${NORMAL}Root login possible. Possible risk!"
		    echo "    info: ${permitrootlogin}"
	          else
		    SIZE=36
		    jump=`expr ${defaultcolumn} - ${SIZE}`			
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} (Remote root login disabled) ]"	    
		fi

		echo -n "   Checking for allowed protocols... "
	    
		protocols=`cat /etc/ssh/sshd_config | grep "Protocol 2" | grep -v "#" | grep -v "2,1"`
		if [ "${protocols}" = "Protocol 2" ]
		  then
		    SIZE=35
		    jump=`expr ${defaultcolumn} - ${SIZE}`			
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} (Only SSH2 allowed) ]"	    
		  else
		    SIZE=46
		    jump=`expr ${defaultcolumn} - ${SIZE}`			
		    echo -e "\033[${jump}C[ ${YELLOW}Warning${NORMAL} Users can use SSH1-protocol. ]"	    
		    echo "    info: ${protocols} (when empty, default option active)"
		fi
	  else
	    echo "${YELLOW}SSH not found. No problem buddy. But don't use telnet for remote administration!${NORMAL}"
	fi

	echo "";
	echo "${test}* Check: Events and Logging${NORMAL}"
	echo -n "   Search for syslog configuration... "
	if [ -e "/etc/syslog.conf" ]
	  then
	    echo "${green}found${NORMAL}"

	    SIZE=38
	    jump=`expr ${defaultcolumn} - ${SIZE}`			

	    echo -n "   Checking for running syslog slave... "
	    
		syslogisrunning=`ps aux | grep "syslogd" | grep -v "grep"`
		if [ "${syslogisrunning}" = "" ]
		  then
		    echo -e "\033[${jump}C[ ${BAD}Warning!${NORMAL} (cannot find syslogd) ]"
		  else
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} ]"	    
	    	fi
		    
	    SIZE=42
	    jump=`expr ${defaultcolumn} - ${SIZE}`			

	    echo -n "   Checking for logging to remote system... "
	    
		logtoremote=`cat /etc/syslog.conf | grep "@" | grep -v "#"`

	        if [ "${logtoremote}" = "" ]
		  then
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} (no remote logging) ]"	    
		  else
		    echo -e "\033[${jump}C[ ${OK}OK${NORMAL} (remote logging) ]"
		    echo "    info: ${logtoremote}"
		fi
	  else
	    echo "${YELLOW}syslog.conf cannot be found${NORMAL}"
	fi

        ENDTIME=`date +%s`
	TOTALTIME=`expr ${ENDTIME} - ${BEGINTIME}`
	
	echo ""; echo ""
	echo "---------------------------- Scan results ----------------------------"
	echo ""
	echo "${YELLOW}MD5${NORMAL}"
	echo "MD5 compared: ${MD5_COUNT}"
	echo -n "Incorrect MD5 checksums: "	
	if [ "${MD5_DIFFERENT}" -eq 0 ]; then
	    echo -n "${OK}"
	  else
	    echo -n "${BAD}"
	fi
	echo "${MD5_DIFFERENT}${NORMAL}"
	echo ""
	echo "${YELLOW}File scan${NORMAL}"
	echo "Scanned files: ${SCANNED_COUNT}"
	echo -n "Possible infected files: "
	if [ "${INFECTED_COUNT}" -eq 0 ]; then
	    echo -n "${OK}"
	  else
	    echo -n "${BAD}"
	fi
	echo "${INFECTED_COUNT}${NORMAL}"
	echo "Possible rootkits: ${INFECTED_NAMES}"
	echo ""
	echo "Scanning took ${TOTALTIME} seconds"
	
	echo ""
	echo "-----------------------------------------------------------------------"
	echo ""
	echo "Having problems? False positives?"
	echo "Please e-mail me by filling in the contact form (@http://www.rootkit.nl)"
	echo ""
	echo "-----------------------------------------------------------------------"
    ;;


  --install | -i )
    echo "Sorry, not implemented yet"
    ;;

  --makesaferoom | -ms )
    echo "* makesaferoom *"
    echo "Sorry, not implemented yet"
    ;;

  --versioncheck )

    LATESTVERSION="unknown"

    if [ -f /tmp/rkhunter.upd ]; then
      rm -f /tmp/rkhunter.upd
    fi

    URLPREFIX=`cat /usr/local/rkhunter/db/mirrors.dat | head -n 1`

    VERSIONUPDATEURL=`cat /usr/local/etc/rkhunter.conf | grep 'LATESTVERSION=' | tr -d 'LATESTVERSION='`
  
    if [ "${WGETFOUND}" -eq 1 ]
      then
	  ${WGETBINARY} -q -O /tmp/rkhunter.upd ${URLPREFIX}${VERSIONUPDATEURL}
	  LATESTVERSION=`cat /tmp/rkhunter.upd`
    fi

    echo ""
    echo "${PROGRAM_NAME} ${PROGRAM_version}, copyright ${PROGRAM_author}"
    echo ""
    echo "This version:   ${PROGRAM_version}"
    echo "Latest version: ${LATESTVERSION}"
    if [ ! "${PROGRAM_version}" = "${LATESTVERSION}" ]
      then
        if [ ! "${LATESTVERSION}" = "unknown" ]
	  then
            echo "${WHITE}Update available${NORMAL}"
	  else
	    echo "${WHITE}Please check manually${NORMAL}"
	fi	  
    fi

    echo "" ; echo ""; echo ""

    
    ;;

    
  --submit | -s )
    ls
    ;;


  *)
    echo "${PROGRAM_NAME} ${PROGRAM_version}, copyright ${PROGRAM_author}"
    echo ""
    echo "Valid parameters:"
    echo "--checkall (-c)              : check system"
    echo "--versioncheck               : check for latest version"    
    echo ""
    echo "${PROGRAM_extrainfo}"
    echo ""
    ;;    

esac

# end of parameter check

# 
# To Do:
# - checking /usr/local/etc/ssh/sshd_config
# - checking /usr/local/etc/sshd_config
#---------------------------------------------------------------------------------------------
#
# - FreeBSD MD5 test:
# ( md5 -x | grep -v 'verified correct' | grep -v 'MD5 test suite:' )
#
# Portacelo:
# String: 'big mess of a failure', 'Here today, gone tommorow' (sshd)
#
# Misc:
# export HISTFILE=/dev/null
# unset HISTFILE
# unset HISTSAVE


# The End
