D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
local
/
maldetect
/
Filename :
maldet
back
Copy
#!/usr/bin/env bash # ## # Linux Malware Detect v1.6.6 # (C) 2002-2025, R-fx Networks <proj@rfxn.com> # (C) 2025, Ryan MacDonald <ryan@rfxn.com> # This program may be freely redistributed under the terms of the GNU GPL v2 ## # PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin ver=1.6.6 inspath='/usr/local/maldetect' intcnf="$inspath/internals/internals.conf" if [ -f "/etc/sysconfig/maldet" ]; then syscnf=/etc/sysconfig/maldet elif [ -f "/etc/default/maldet" ]; then syscnf=/etc/default/maldet fi header() { echo "Linux Malware Detect v$ver" echo " (C) 2002-2023, R-fx Networks <proj@rfxn.com>" echo " (C) 2023, Ryan MacDonald <ryan@rfxn.com>" echo "This program may be freely redistributed under the terms of the GNU GPL v2" echo "" } if [ -f "$intcnf" ]; then source $intcnf else header echo "maldet($$): {glob} \$intcnf not found, aborting." exit 1 fi if [ -f "$cnf" ]; then source $cnf else header echo "maldet($$): {glob} \$cnf not found, aborting." exit 1 fi if [ -f "$intfunc" ]; then source $intfunc else header echo "maldet($$): {glob} \$intfunct not found, aborting." exit 1 fi if [ -f "$compatcnf" ]; then source $compatcnf fi if [ -f "$syscnf" ]; then source $syscnf fi # prerun operations prerun if [ -z "$1" ]; then header usage_short else while [ -n "$1" ]; do case "$1" in --mkpubpaths) if [ "$scan_user_access" == "1" ]; then chmod 711 $userbasedir for user in `cat /etc/passwd | cut -d ':' -f1`; do uid=`id --user $user` if [ -z "$uid" ]; then uid=9 fi if [ -z "$scan_user_access_minuid" ]; then scan_user_access_minuid=10 fi if [ "$uid" -ge "$scan_user_access_minuid" ] && [ ! -d "$userbasedir/$user" ]; then mkdir -p $userbasedir/$user/quar $userbasedir/$user/sess $userbasedir/$user/tmp touch $userbasedir/$user/event_log chown -R $user $userbasedir/$user chmod 750 $userbasedir/$user $userbasedir/$user/quar $userbasedir/$user/sess $userbasedir/$user/tmp chmod 640 $userbasedir/$user/event_log eout "{glob} created public scanning paths for user $user" fi unset uid user done exit else header echo "public scanning support not enabled in $cnf, aborting." exit fi ;; -hscan|--hook-scan|--modsec) hscan=1 ;; -U|--user) shift user="$1" quardir=$userbasedir/$user/quar sessdir=$userbasedir/$user/sess tmpdir=$userbasedir/$user/tmp maldet_log=$userbasedir/$user/event_log ;; -co|--config-option) shift user=`whoami` if [ ! "$user" == "root" ]; then tmpdir=$userbasedir/$user/tmp fi tmpco=$tmpdir/config.cli rm -f $tmpco touch $tmpco echo ,$1 | sed -e 's/-\(-config-option\|co\) //' -e 's/\(, *[a-zA-Z0-9_][a-zA-Z0-9_]*=\)/\n\1\n/g' | sed -e '1d' -e 's/^\([^,].*\|.*[^=]\)$/"\1"/' | sed -e '$!N;s/\n//' -e 's/^, *//' | grep -v "^ *compatcnf" > $tmpco . $tmpco rm -f $tmpco if [ -f "$compatcnf" ]; then source $compatcnf fi ;; -qd) shift if [ -d "$1" ]; then eout "{scan} set quarantine path: $1" 1 quardir="$1" fi ;; -b|--background) set_background=1 ;; -c|--checkout) shift header checkout "$1" ;; -x|--exclude-regex) shift if [ "$1" ]; then exclude_regex="-not -regex \"$1\"" fi ;; -i|--include-regex) shift if [ "$1" ]; then include_regex="-regex \"$1\"" fi ;; --wget-proxy|--curl-proxy|--web-proxy) shift if [ "$1" ]; then web_proxy="$1" fi ;; --alert-daily|--monitor-report) genalert digest ;; -m|--monitor) header shift if [ "$OSTYPE" == "FreeBSD" ]; then eout "{mon} not currently supported under FreeBSD" 1 elif [ "$1" == "reload" ] || [ "$1" == "RELOAD" ]; then eout "{mon} queued monitor for configuration reload" 1 touch $inspath/reload_monitor elif [ ! -f "$(which ed 2> /dev/null)" ]; then eout "{mon} could not find monitor mode dependency 'ed' in PATH, please apt/yum/dnf install ed and try again." 1 else svc=m trap trap_exit 2 monitor_init "$1" fi ;; -k|--kill-monitor|-kill) header if [ "$OSTYPE" == "FreeBSD" ]; then eout "{mon} not currently supported under FreeBSD" 1 else monitorpid=`pgrep -f inotify.paths.[0-9]+` if [ -z "$monitorpid" ]; then eout "{mon} could not find running inotifywait process, are we already dead?" 1 else eout "{mon} sent kill to monitor service (pid: $monitorpid)" 1 monitor_kill fi fi ;; -f|--file-list) shift if [ -z "$hscan" ]; then header fi svc=f trap trap_exit 2 file_list="$1" if [ ! -f "$file_list" ]; then eout "{scan} file does not exist ($1)" 1 exit 1 elif [ ! -s "$file_list" ]; then eout "{scan} file list is empty ($1)" 1 exit 1 fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath to background, see $maldet_log for progress" 1 scan "$spath" "$file_list" >> /dev/null 2>&1 & else scan "$spath" "$file_list" fi ;; -a|--scan-all) shift if [ -z "$hscan" ]; then header fi svc=a trap trap_exit 2 spath="$1" hrspath="$1" if [ "$spath" == "" ]; then spath=/home hrspath="$spath" fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath to background, see $maldet_log for progress" 1 scan "$spath" all >> /dev/null 2>&1 & else scan "$spath" all fi ;; -r|--scan-recent) header svc=r trap trap_exit 2 shift spath="$1" hrspath="$1" shift days="$1" if [ -z "$spath" ]; then eout "{scan} no path defined" 1 exit fi if [ -z "$days" ]; then days=7 fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath changes in last ${days}d to background, see $maldet_log for progress" 1 scan "$spath" "$days" >> /dev/null 2>&1 & else scan "$spath" "$days" fi ;; -l|--log) header view ;; -e|--report) header shift view_report "$1" "$2" ;; -E|--dump-report) header shift dump_report "$1" ;; -p|--purge) header purge ;; -d|--update-ver|--update-version) shift if [ ! "$1" == "1" ]; then header fi if [ "$1" == "--force" ]; then lmdup_force=1 elif [ "$1" == "--beta" ]; then lmdup_beta=1 fi lmdup ;; -u|--update|--update-sigs) shift if [ ! "$1" == "1" ]; then header fi if [ "$1" == "--force" ]; then sigup_force=1 fi sigup ;; -s|--restore) header shift if [ -f "$sessdir/session.hits.$1" ]; then restore_hitlist "$1" else restore "$1" fi ;; -q|--quarantine) header shift quar_hitlist "$1" ;; -n|--clean) header shift clean_hitlist "$1" ;; -h|--help) header usage_long | more ;; *) header usage_short esac shift done fi # import any remote configuration data import_conf # postrun operations postrun