ANTI-ROOTKIT

#!/usr/bin/python
# -*- coding: iso8859-1 -*- 

import os,md5
from string import split
from sys import exit


def Scanner():
	e = """
#!/usr/bin/python
# -*- coding: iso8859-1 -*- 

import os,md5
from string import split
from sys import exit


class Scanner:
	def __init__(self):
		self.corrupt = []
		self.lst = ["ls","ps","find","sudo","vim","gvim","ssh"]
		self.liste = os.listdir('/usr/bin')
		self.LenB = len(self.liste)
		try:self.BinaireSauv = open('/usr/.SauvgardeBinaire/MD5Sauv','r').read()
		except:print ("[!] Erreur : fichier invalid")
		self.BinaireSauv = split(self.BinaireSauv)
		self.LenBinSauv = self.BinaireSauv[(len(self.BinaireSauv)-1)]
		
	def LenBinaire(self):
		if (self.LenB == int(self.LenBinSauv)):
			self.Modif = 0
		else:
			self.Modif = 1
	
	def ScanBin(self):
		for buff in self.lst:
			MD5bin = "/usr/bin/%s"%(buff)
			MD5Bin = "%s"%(md5.new(MD5bin).hexdigest())
			i = 0
			while (i < len(self.BinaireSauv)):
				if (buff == self.BinaireSauv[i]):
					if (self.BinaireSauv[i+1] == MD5Bin):
						print ("[*] %s clean ."%(buff))
					else :
						print ("[!] %s modifier ."%(buff))
						self.corrupt.append(buff)
				i += 1

	def ResultScan(self):
		print ("Result fro the scan :")
		if (self.Modif == 1):
			print ("[!] Nombre des binaires </usr/bin> modifier")
		if (len(self.corrupt) > 0 ):
			self.corrupted = 1
			for buff in self.corrupt:
				print ("	[!] %s is corrupted"%(buff))
				
		else:
			self.corrupted = 0
			print ("[*] binaire clean .")
		print ("")

	def Desinfect(self):
		for buff in self.corrupt:
			Binn = "/usr/.SauvgardeBinaire/%s"%(buff)
			MD5bin = "/usr/bin/%s"%(buff)
			copie = open(Binn,'rb').read()
			OpenBinary = open(MD5bin,'w')
			OpenBinary.write(copie)
			OpenBinary.close()

def Root():
	uid = os.getuid()
	if (uid != 0):
		exit("[!] Erreur : Root necessaire")

def main():
	print \"\"\"
	       ********************************
	       * Anti-Rootkit Binary modifier *
	       *              by              *
	       *            Marnage           *
	       *            Scanner           *
	       ********************************\"\"\"
	Root()
	print ("[-] Scan en cour ...")
	Scan = Scanner()
	Scan.LenBinaire()
	Scan.ScanBin()
	Scan.ResultScan()
	if (Scan.corrupted ):
		confirm = raw_input("Remplacer les binaires par les sauvgardes : y or n ? -> ")
		if (confirm == 'y'):
			Scan.Desinfect()

if __name__ == "__main__":
	main()"""
	file = open("Scanner.py","w")
	file.write(e)
	file.close()

class Sauvgarde:
	def __init__(self):
		try:
			print ("[*] Generation de la sauvgarde et des hashmd5 en cour ...")
			os.mkdir('/usr/.SauvgardeBinaire')
			self.lst = ["ls","ps","find","sudo","vim","gvim","ssh"]
			self.MD5Sauv = open('/usr/.SauvgardeBinaire/MD5Sauv','w')
			for buff in self.lst:
				MD5bin = "/usr/bin/%s"%(buff)
				self.MD5Bin = "%s %s\n"%(buff,md5.new(MD5bin).hexdigest())
				self.MD5Sauv.write(self.MD5Bin)
				os.system("touch /usr/.SauvgardeBinaire/.%s"%(buff))
				Ecr = "/usr/.SauvgardeBinaire/%s"%(buff)
				try:copie = open(MD5bin,'rb').read()
				except: print ("[!] Erreur :bianire introuvable .")
				EcrireCop = open(Ecr,'w')
				EcrireCop.write(copie)
				EcrireCop.close()
			self.liste = os.listdir('/usr/bin')
			self.LenB = len(self.liste)
			self.MD5Sauv.write(str(self.LenB))
			self.MD5Sauv.close()
			print ("[*] Generation effectuer avec succe .")
		except : print ("[!] Erreor: Generation non resussi  !")

def Root():
	uid = os.getuid()
	if (uid != 0):
		exit("[!] Erreur : Root necessaire")

def main():
	print """
	       ********************************
	       * Anti-Rootkit Binary modifier *
	       *              by              *
	       *            Marnage           *
	       *             Setup            *
	       ********************************\n"""
	Root()
	Sauv = Sauvgarde()
	Scanner()

if __name__ == "__main__":
	main()

01 octobre 2007 23:58:49 :

!