Search
Search
Search
Search
Information
Information
Light
Dark
Open actions menu
Basic upload method
Bypass upload method
Tips!
If you encounter an error (by firewall) while uploading using both methods,
try changing extension of the file before uploading it and rename it right after.
Submit
~
usr
local
maldetect.bk1444312
File Content:
maldet
#!/usr/bin/env bash # ## # Linux Malware Detect v1.6.6 # (C) 2002-2025, R-fx Networks <proj@rfxn.com> # (C) 2025, Ryan MacDonald <ryan@rfxn.com> # This program may be freely redistributed under the terms of the GNU GPL v2 ## # PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin ver=1.6.6 inspath='/usr/local/maldetect' intcnf="$inspath/internals/internals.conf" if [ -f "/etc/sysconfig/maldet" ]; then syscnf=/etc/sysconfig/maldet elif [ -f "/etc/default/maldet" ]; then syscnf=/etc/default/maldet fi header() { echo "Linux Malware Detect v$ver" echo " (C) 2002-2023, R-fx Networks <proj@rfxn.com>" echo " (C) 2023, Ryan MacDonald <ryan@rfxn.com>" echo "This program may be freely redistributed under the terms of the GNU GPL v2" echo "" } if [ -f "$intcnf" ]; then source $intcnf else header echo "maldet($$): {glob} \$intcnf not found, aborting." exit 1 fi if [ -f "$cnf" ]; then source $cnf else header echo "maldet($$): {glob} \$cnf not found, aborting." exit 1 fi if [ -f "$intfunc" ]; then source $intfunc else header echo "maldet($$): {glob} \$intfunct not found, aborting." exit 1 fi if [ -f "$compatcnf" ]; then source $compatcnf fi if [ -f "$syscnf" ]; then source $syscnf fi # prerun operations prerun if [ -z "$1" ]; then header usage_short else while [ -n "$1" ]; do case "$1" in --mkpubpaths) if [ "$scan_user_access" == "1" ]; then chmod 711 $userbasedir for user in `cat /etc/passwd | cut -d ':' -f1`; do uid=`id --user $user` if [ -z "$uid" ]; then uid=9 fi if [ -z "$scan_user_access_minuid" ]; then scan_user_access_minuid=10 fi if [ "$uid" -ge "$scan_user_access_minuid" ] && [ ! -d "$userbasedir/$user" ]; then mkdir -p $userbasedir/$user/quar $userbasedir/$user/sess $userbasedir/$user/tmp touch $userbasedir/$user/event_log chown -R $user $userbasedir/$user chmod 750 $userbasedir/$user $userbasedir/$user/quar $userbasedir/$user/sess $userbasedir/$user/tmp chmod 640 $userbasedir/$user/event_log eout "{glob} created public scanning paths for user $user" fi unset uid user done exit else header echo "public scanning support not enabled in $cnf, aborting." exit fi ;; -hscan|--hook-scan|--modsec) hscan=1 ;; -U|--user) shift user="$1" quardir=$userbasedir/$user/quar sessdir=$userbasedir/$user/sess tmpdir=$userbasedir/$user/tmp maldet_log=$userbasedir/$user/event_log ;; -co|--config-option) shift user=`whoami` if [ ! "$user" == "root" ]; then tmpdir=$userbasedir/$user/tmp fi tmpco=$tmpdir/config.cli rm -f $tmpco touch $tmpco echo ,$1 | sed -e 's/-\(-config-option\|co\) //' -e 's/\(, *[a-zA-Z0-9_][a-zA-Z0-9_]*=\)/\n\1\n/g' | sed -e '1d' -e 's/^\([^,].*\|.*[^=]\)$/"\1"/' | sed -e '$!N;s/\n//' -e 's/^, *//' | grep -v "^ *compatcnf" > $tmpco . $tmpco rm -f $tmpco if [ -f "$compatcnf" ]; then source $compatcnf fi ;; -qd) shift if [ -d "$1" ]; then eout "{scan} set quarantine path: $1" 1 quardir="$1" fi ;; -b|--background) set_background=1 ;; -c|--checkout) shift header checkout "$1" ;; -x|--exclude-regex) shift if [ "$1" ]; then exclude_regex="-not -regex \"$1\"" fi ;; -i|--include-regex) shift if [ "$1" ]; then include_regex="-regex \"$1\"" fi ;; --wget-proxy|--curl-proxy|--web-proxy) shift if [ "$1" ]; then web_proxy="$1" fi ;; --alert-daily|--monitor-report) genalert digest ;; -m|--monitor) header shift if [ "$OSTYPE" == "FreeBSD" ]; then eout "{mon} not currently supported under FreeBSD" 1 elif [ "$1" == "reload" ] || [ "$1" == "RELOAD" ]; then eout "{mon} queued monitor for configuration reload" 1 touch $inspath/reload_monitor elif [ ! -f "$(which ed 2> /dev/null)" ]; then eout "{mon} could not find monitor mode dependency 'ed' in PATH, please apt/yum/dnf install ed and try again." 1 else svc=m trap trap_exit 2 monitor_init "$1" fi ;; -k|--kill-monitor|-kill) header if [ "$OSTYPE" == "FreeBSD" ]; then eout "{mon} not currently supported under FreeBSD" 1 else monitorpid=`pgrep -f inotify.paths.[0-9]+` if [ -z "$monitorpid" ]; then eout "{mon} could not find running inotifywait process, are we already dead?" 1 else eout "{mon} sent kill to monitor service (pid: $monitorpid)" 1 monitor_kill fi fi ;; -f|--file-list) shift if [ -z "$hscan" ]; then header fi svc=f trap trap_exit 2 file_list="$1" if [ ! -f "$file_list" ]; then eout "{scan} file does not exist ($1)" 1 exit 1 elif [ ! -s "$file_list" ]; then eout "{scan} file list is empty ($1)" 1 exit 1 fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath to background, see $maldet_log for progress" 1 scan "$spath" "$file_list" >> /dev/null 2>&1 & else scan "$spath" "$file_list" fi ;; -a|--scan-all) shift if [ -z "$hscan" ]; then header fi svc=a trap trap_exit 2 spath="$1" hrspath="$1" if [ "$spath" == "" ]; then spath=/home hrspath="$spath" fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath to background, see $maldet_log for progress" 1 scan "$spath" all >> /dev/null 2>&1 & else scan "$spath" all fi ;; -r|--scan-recent) header svc=r trap trap_exit 2 shift spath="$1" hrspath="$1" shift days="$1" if [ -z "$spath" ]; then eout "{scan} no path defined" 1 exit fi if [ -z "$days" ]; then days=7 fi if [ "$set_background" == "1" ]; then eout "{scan} launching scan of $spath changes in last ${days}d to background, see $maldet_log for progress" 1 scan "$spath" "$days" >> /dev/null 2>&1 & else scan "$spath" "$days" fi ;; -l|--log) header view ;; -e|--report) header shift view_report "$1" "$2" ;; -E|--dump-report) header shift dump_report "$1" ;; -p|--purge) header purge ;; -d|--update-ver|--update-version) shift if [ ! "$1" == "1" ]; then header fi if [ "$1" == "--force" ]; then lmdup_force=1 elif [ "$1" == "--beta" ]; then lmdup_beta=1 fi lmdup ;; -u|--update|--update-sigs) shift if [ ! "$1" == "1" ]; then header fi if [ "$1" == "--force" ]; then sigup_force=1 fi sigup ;; -s|--restore) header shift if [ -f "$sessdir/session.hits.$1" ]; then restore_hitlist "$1" else restore "$1" fi ;; -q|--quarantine) header shift quar_hitlist "$1" ;; -n|--clean) header shift clean_hitlist "$1" ;; -h|--help) header usage_long | more ;; *) header usage_short esac shift done fi # import any remote configuration data import_conf # postrun operations postrun
Edit
Rename
Chmod
Delete
