Skip to content

Commit

Permalink
detect root kits
Browse files Browse the repository at this point in the history
  • Loading branch information
rootTHC committed Nov 27, 2024
1 parent 631959c commit 3b4b699
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions hackshell.sh
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,8 @@ xor() {
perl -e 'while(<>){foreach $c (split //){print $c^chr('"${1:-0xfa}"');}}'
}

xorpipe() { xor | sed 's/\r/\n/g'; }

# HS_TRANSFER_PROVIDER="transfer.sh"
HS_TRANSFER_PROVIDER="oshi.at"

Expand Down Expand Up @@ -1042,15 +1044,15 @@ _warn_rk() {
[ -n "$tainted" ] && {
echo -e "${CR}Non standard LKM detected${CF} (/proc/sys/kernel/tainted=$n)"
while read -r m; do
cat "/proc/modules" 2>/dev/null | while read -r m; do
m="${m%% *}"
str="$(modinfo "$m")"
{ [[ "$str" != *"Build time autogenerated kernel"* ]] || [[ "$str" != *"intree: Y"* ]]; } && {
# echo "$m"
modinfo "$m" | grep --color=never -E '(^filename|^author)'
continue
}
done </proc/modules
done
echo -en "${CN}"
}
}
Expand Down Expand Up @@ -1736,3 +1738,6 @@ lootlight
# unset all functions that are no longer needed.
unset -f hs_init hs_init_alias hs_init_dl hs_init_shell
unset SSH_CONNECTION SSH_CLIENT _HSURLORIGIN
# Do exit with TRUE in case parent shell ues 'set -e':
:

0 comments on commit 3b4b699

Please sign in to comment.