View source for Get status of MalDet hits

[[Category:One Liners]]
==Overview==
Get the status of files found in maldet scans. There are several different functions that can then be run.

==Script==
There are two main versions: 

1) Look at only the last scan

2) Look at the entire log

===Last Scan Version===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs ls -lah $i 2>/dev/null
</source>

===All Scans Version===
<source lang='bash'>
grep "malware hit" /usr/local/maldetect/event_log | grep "{hexstring}\|{md5hash}" | awk '{print $11}' | xargs ls -lah $i 2>/dev/null
</source>

==What to change==
Remove everything between the do and done

===Read Files===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs vim 2>/dev/null
</source>

===Chmod 000===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs chmod 000 2>/dev/null
</source>

===Remove===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs rm -f 2>/dev/null
</source>

==Other uses==
===Check Directory Permissions===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | xargs ls -ldh 2>/dev/null
</source>

===Chmod 644 (images)===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep "image" | xargs chmod 0644
</source>

===Chmod 755 (other)===
<source lang='bash'>
cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image" | xargs chmod 0755
</source>

===Stop Script Execution (images)===
Careful with this one, they may have legitimate scripts in these directories =_=
<source lang='bash'>
for i in $(cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image"); \
do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already has .htaccess"; fi; done
</source>

==Scan Types==
===Scan All Users Full Home Directories===
<source lang='bash'>
maldet --update-ver; maldet --update; maldet -a /home?/?/
</source>
===Scan All Users Public_HTML Directories===
<source lang='bash'>
maldet --update-ver; maldet --update; maldet -a /home?/?/public_html
</source>