<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>[blog.rayfoo] &#187; Finnix</title>
	<atom:link href="http://blog.rayfoo.info/tag/finnix/feed" rel="self" type="application/rss+xml" />
	<link>http://blog.rayfoo.info</link>
	<description>Infosec, DFIR, tech geekery, thoughts and whatnot</description>
	<lastBuildDate>Wed, 25 Jan 2012 00:36:47 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Verifying rkhunter file warnings</title>
		<link>http://blog.rayfoo.info/2009/10/verifying-rkhunter-file-warnings</link>
		<comments>http://blog.rayfoo.info/2009/10/verifying-rkhunter-file-warnings#comments</comments>
		<pubDate>Mon, 12 Oct 2009 06:46:26 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[detection]]></category>
		<category><![CDATA[Finnix]]></category>
		<category><![CDATA[hardening]]></category>
		<category><![CDATA[rkhunter]]></category>
		<category><![CDATA[rootkit]]></category>
		<category><![CDATA[scripts]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[server administration]]></category>
		<category><![CDATA[tools]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=250</guid>
		<description><![CDATA[I got this problem as my rkhunter installation detected changed files (due to updates), so I encountered this solution by steve as I was searching for a solution. Of course, as there could be a root kit/trojan/malicious stuff running in your system as rkhunter's meant to detect, you should NOT fully trust anything running from [...]]]></description>
			<content:encoded><![CDATA[<p>I got this problem as my <a href="http://www.rootkit.nl/projects/rootkit_hunter.html">rkhunter</a> installation detected changed files (due to updates), so I encountered this <a href="http://www.shuningbian.net/2009/06/dealing-with-rkhunter-warnings.php">solution</a> by <a href="http://www.shuningbian.net/">steve</a> as I was searching for a solution.</p>
<p>Of course, as there could be a root kit/trojan/malicious stuff running in your system as rkhunter's meant to detect, you should NOT fully trust anything running from the machine.  But I had to rely on this solution temporarily until I can get it (rebooted and) checked out proper using a tool like <a href="http://www.finnix.org/">Finnix</a>.<br />
Am reposting the script here for reference, but you can get the most recent copy of the script <a href="http://git.pictorii.com/?p=scripts.git;a=blob_plain;f=verify.sh;hb=rei">here</a> .<br />
<span id="more-250"></span></p>
<p>
<pre style="color:green">#!/bin/bash
desc="
This script will verify whether files for which rkhunter has logged a
warning for is still valid. It does this by finding which debian package
it came out of, and downloads them, unpacks them, then checks
the checksums.

Run it by supplying a rkhunter log file as first argument
"

HASHER="sha256sum"

IFS="
"
function find_suspect_files
{
	echo "parsing $1 for suspect files" 1>&#038;2
	grep -1 Warning "$1"| grep File | sed 's|.*File: ||'
}

function find_packages
{
	echo "finding packages" 1>&#038;2
	for suspect_file in $1
	do
		package=$(dpkg -S $suspect_file|awk '{print $1}'|sed 's/.$//')
		echo "suspect file $suspect_file found in $package" 1>&#038;2
		echo $package
	done

}

function make_aptitude_args
{
	echo "generating aptitude arguments" 1>&#038;2
	for package in $1
	do
		version=$(dpkg -p $package | grep Version | awk '{print $2}')
		echo $package=$version
	done
}

function cleanup
{
	echo "cleaning up"
	popd
	rm -rf tmp
	exit $1
}

function setup
{
	echo "setting up"
	rm -rf tmp
	mkdir tmp
	pushd tmp
}

if [ $# -ne 1 ];
then
	echo "$desc"
	exit 1
fi

suspect_files=$(find_suspect_files "$1")

packages=$(find_packages "$suspect_files" | sort | uniq)

if [ -z "$packages" ];
then
	echo "***WARNING****"
	echo "No packages contain any of the suspect files!"
	cleanup 1
fi

aptitude_args=$(make_aptitude_args "$packages")

setup

echo "downloading packages"
aptitude download $aptitude_args 1>/dev/null
if [ $? -ne 0 ];
then
	echo "aptitude download failed!"
	echo "args=$aptitude_args"
	cleanup 1
fi

echo "unpacking"
for deb_file in *.deb
do
	ar -x $deb_file
	tar zxf data.tar.gz
	rm -rf data.tar.gz control.tar.gz
done

for suspect_file in $suspect_files
do
	if [ ! -f ".$suspect_file" ]
	then
		echo "***WARNING****"
		echo "For some reason .$suspect_file does not exis!"
		continue
	fi
	echo -n "verifying $suspect_file... "
	suspect_sum=$($HASHER $suspect_file | awk '{print $1}')
	clean_sum=$($HASHER ".$suspect_file" | awk '{print $1}')
	if [ $suspect_sum == $clean_sum ];
	then
		echo "OK"
	else
		echo
		echo "***WARNING****"
		echo "Checksum mistmatch for $suspect_file!!!"
		echo "Should be: $clean_sum"
		echo "Is: $suspect_sum"
	fi
done
cleanup</pre></p>
]]></content:encoded>
			<wfw:commentRss>http://blog.rayfoo.info/2009/10/verifying-rkhunter-file-warnings/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

