MYNITOR.COM

Recently one of my servers was hacked and my first reaction was to freak out and panic.  After I calmed myself down, I immediately stopped the front door the attackers had gotten to the server by shutting down the apache server.

After that, I had no idea where to start looking for backdoors that maybe installed on the system.  So i downloaded highly recommended rootkits for exactly these types of situations.  The following rootkits helped me identify the issues on my system and figure out what to do.

1. Rootkit Hunter – scans files and systems for known and unknown rootkits, backdoors, sniffers, and malware. The application consists of the main shell script, a few text-based databases, and optional Perl scripts. It can recognise and run external applications like ‘skdet’ and ‘unhide’. It should run on almost every Unix clone.
2. chkrootkit – a tool to locally check for signs of a rootkit. It contains a chkrootkit: shell script that checks system binaries for rootkit modification. The following tests are made: aliens, asp, bindshell, lkm, rexedcs, sniffer, wted, z2, amd, basename, biff, chfn, chsh, cron, date, du, dirname, echo, egrep, env, find, fingerd, gpm, grep, hdparm, su, ifconfig, inetd, inetdconf, identd, killall, login, ls, mail, mingetty, netstat, named, passwd, pidof, pop2, pop3, ps, pstree, rpcinfo, rlogind, rshd, slogin, sendmail, sshd, syslogd, tar, tcpd, top, telnetd, timed, traceroute, and write.
3. OSSEC HIDS – a host-based intrusion detection system. It performs log analysis, integrity checking, rootkit detection, time-based alerting, and active response.
4. Zeppoo – allows you to detect rootkits on the i386 architecture under Linux by using /dev/kmem and /dev/mem. It can also detect hidden tasks, modules, syscalls, some corrupted symbols, and hidden connections. Anti-Rootkits which don’t use these methods can be fooled easily.
5. Rkdet – a small daemon intended to catch someone installing a rootkit or running a packet sniffer. It takes a snapshot of processes and network connections, then disconnects from the network. It may be built to watch arbitrary files such as Web pages.