LinuxCheck

Linux emergency response/information gathering/vulnerability detection tool, supporting 13 categories and 70+ checks including basic configuration/network traffic/task scheduling/environment variables/user information/Services/bash/malicious files/kernel Rootkit/SSH/Webshell/mining files/mining processes/supply chain/server risks, etc.

Updates

Update Log: April 20, 2024

• Adjusted output to Markdown report
• Deprecated ag, still using Linux native grep command to avoid additional installation
• Optimized code format, no longer need tee -a for each line
• Updated Webshell detection logic
• Updated authorized_keys detection logic
• Added JDWP and Python HTTP Server checks to server risk checks
• Added Docker container detection
• Added PAM backdoor detection
• Added local report upload capability to handle batch machine emergencies.

Update Log: August 5, 2022

• Fixed issue of excessive logs in kernel module check

Update Log: March 7, 2022

• Added SSH symlink backdoor detection

Update Date: October 17, 2021

• Added Ntpclient/WorkMiner/TeamTNT mining malware detection
• Added Rootkit module detection logic
• Added Python pip poisoning detection
• Added $HOME/.profile view
• Added server risk check (Redis)

Features

• Basic Configuration Check
  • System configuration change check
  • System information (IP address/user/uptime/system version/Hostname/server SN)
  • CPU usage
  • Logged-in user information
  • CPU TOP 15
  • Memory TOP 15
  • Disk free space check
  • Disk mounts
  • Common software check
  • /etc/hots
• Network/Traffic Check
  • ifconfig
  • Network traffic
  • Port listening
  • Open external ports
  • Network connections
  • TCP connection status
  • Routing table
  • IP forwarding
  • DNS Server
  • ARP
  • Network card promiscuous mode check
  • iptables firewall
• Task Scheduling Check
  • Current user's tasks
  • /etc/ system tasks
  • Task file creation time
  • Crontab backdoor investigation
• Environment Variable Check
  • env
  • path
  • LD_PRELOAD
  • LD_ELF_PRELOAD
  • LD_AOUT_PRELOAD
  • PROMPT_COMMAND
  • LD_LIBRARY_PATH
  • ld.so.preload
• User Information Check
  • Users who can log in
  • passwd file modification date
  • sudoers
  • Login information (w/last/lastlog)
  • Historical login IPs
• Services Check
  • SystemD running services
  • SystemD service creation time
• bash Check
  • History
  • History command audit
  • /etc/profile
  • $HOME/.profile
  • /etc/rc.local
  • ~/.bash_profile
  • ~/.bashrc
  • Bash reverse shell
• File Check
  • Hidden files
  • System file modification time check
  • Temporary file check (/tmp /var/tmp /dev/shm)
  • alias
  • SUID special permission check
  • Process exists but file not found
  • File changes in the last 7 days (mtime)
  • File changes in the last 7 days (ctime)
  • Large files >200MB
  • Sensitive file audit (nmap/sqlmap/ew/frp/nps and other common hacker tools)
  • Suspicious hacker files (hacker-uploaded wget/curl programs, or malicious programs renamed to normal software, e.g., nps file renamed to mysql)
• Kernel Rootkit Check
  • lsmod suspicious modules
  • Kernel symbol table check
  • Rootkit hunter check
  • Rootkit .ko module check
• SSH Check
  • SSH brute force
  • SSHD detection
  • SSH backdoor configuration
  • SSH inetd backdoor check
  • SSH key
• Webshell Check
  • PHP webshell check
  • JSP webshell check
• Mining File/Process Check
  • Mining file check
  • Mining process check
  • WorkMiner detection
  • Ntpclient detection
• Supply Chain Poisoning Check
  • Python PIP poisoning check
• Server Risk Check
  • Redis weak password detection
  • JDWP service detection
  • Python http.server detection
• Docker Permission Check

Usage

First method: install via git clone

git clone https://github.com/al0ne/LinuxCheck.git
chmod u+x LinuxCheck.sh
./LinuxCheck.sh  

Second method: directly invoke online [Online invocation cannot use the report upload capability]

bash -c "$(curl -sSL https://raw.githubusercontent.com/al0ne/LinuxCheck/master/LinuxCheck.sh)"  

The file will be saved in the format ipaddr_hostname_username_timestamp.log

Report Auto Upload

If deploying on multiple machines, after the script runs, it will automatically submit to a URL. Change the webhook_url in the script to your own address.

# 报告上报的地址
webhook_url='http://localhost:5000/upload'

upload_report() {

  # 上传到指定接口
  if [[ -n $webhook_url ]]; then
    curl -X POST -F "file=@$filename" "$webhook_url"
  fi

}

Start a Flask service on your server to receive the Markdown reports uploaded by the servers.

from flask import Flask, request

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return "No file part", 400
    file = request.files['file']
    if file.filename == '':
        return "No selected file", 400
    if file:
        filename = file.filename
        file.save(filename)
        return "File successfully uploaded", 200

if __name__ == '__main__':
    app.run(debug=True, host="0.0.0.0", port=9999)

References

The writing of this tool mainly referenced the following tools/articles and combined with personal experience.

Linenum https://github.com/lis912/Evaluation_tools
https://ixyzero.com/blog/archives/4.html
https://github.com/T0xst/linux
https://github.com/grayddq/GScan