Get status of MalDet hits - Revision history

Smsldoo at 14:27, 25 March 2014

2014-03-25T14:27:12Z

Smsldoo at 17:39, 17 February 2012

2012-02-17T17:39:21Z

Smsldoo: /* Other uses */

2011-06-30T16:50:56Z

‎Other uses

Smsldoo: /* Chmod 644 (images) */

2011-06-29T16:48:49Z

‎Chmod 644 (images)

Smsldoo: /* Stop Script Execution (images) */

2011-06-29T14:44:41Z

‎Stop Script Execution (images)

Smsldoo: /* Stop Script Execution (images) */

2011-06-29T14:43:53Z

‎Stop Script Execution (images)

Smsldoo: /* What to change */

2011-06-29T14:42:51Z

‎What to change

Smsldoo: /* Other uses */

2011-06-29T14:42:22Z

‎Other uses

Smsldoo: /* Last Scan Version */

2011-06-29T13:49:35Z

‎Last Scan Version

Smsldoo: /* Chmod 755 (other) */

2011-06-29T12:39:19Z

‎Chmod 755 (other)

@@ Line 11: / Line 11: @@
 ===Last Scan Version===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs ls -lah $i 2>/dev/null
-</code>
+</source>
 ===All Scans Version===
-<code>[bash,n]
+<source lang='bash'>
 grep "malware hit" /usr/local/maldetect/event_log | grep "{hexstring}\|{md5hash}" | awk '{print $11}' | xargs ls -lah $i 2>/dev/null
-</code>
+</source>
 ==What to change==
@@ Line 24: / Line 24: @@
 ===Read Files===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs vim 2>/dev/null
-</code>
+</source>
 ===Chmod 000===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs chmod 000 2>/dev/null
-</code>
+</source>
 ===Remove===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | xargs rm -f 2>/dev/null
-</code>
+</source>
 ==Other uses==
 ===Check Directory Permissions===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | xargs ls -ldh 2>/dev/null
-</code>
+</source>
 ===Chmod 644 (images)===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep "image" | xargs chmod 0644
-</code>
+</source>
 ===Chmod 755 (other)===
-<code>[bash,n]
+<source lang='bash'>
 cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image" | xargs chmod 0755
-</code>
+</source>
 ===Stop Script Execution (images)===
 Careful with this one, they may have legitimate scripts in these directories =_=
-<code>[bash,n]
+<source lang='bash'>
 for i in $(cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image"); \
 do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already has .htaccess"; fi; done
-</code>
+</source>
 ==Scan Types==
 ===Scan All Users Full Home Directories===
-<code>[bash,n]
+<source lang='bash'>
 maldet --update-ver; maldet --update; maldet -a /home?/?/
-</code>
+</source>
 ===Scan All Users Public_HTML Directories===
-<code>[bash,n]
+<source lang='bash'>
 maldet --update-ver; maldet --update; maldet -a /home?/?/public_html
-</code>
+</source>

← Older revision		Revision as of 17:39, 17 February 2012
Line 1:		Line 1:
		+	[[Category:One Liners]]
	==Overview==		==Overview==
	Get the status of files found in maldet scans. There are several different functions that can then be run.		Get the status of files found in maldet scans. There are several different functions that can then be run.

@@ Line 58: / Line 58: @@
 for i in $(cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image"); \
 do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already has .htaccess"; fi; done
 </code>

@@ Line 45: / Line 45: @@
 ===Chmod 644 (images)===
 <code>[bash,n]
-cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep "image" | xargs chmod 0744
+cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep "image" | xargs chmod 0644
 </code>

@@ Line 57: / Line 57: @@
 <code>[bash,n]
 for i in $(cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` | grep "{HEX}\|{MD5}" | awk '{print $3}' | rev | cut -d "/" -f2- | rev | uniq | grep -v "image"); \
-do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already had htaccess"; fi; done
+do if [ ! -e $i/.htaccess] then; echo -e "Options None\nAddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi\n" > $i/.htaccess; else; echo "$i already has .htaccess"; fi; done
 </code>

← Older revision		Revision as of 12:39, 29 June 2011
Line 49:		Line 49:

	===Chmod 755 (other)===		===Chmod 755 (other)===
−	<code>[bash,n]~~for i in $(~~cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` \| grep "{HEX}\\|{MD5}" \| awk '{print $3}' \| rev \| cut -d "/" -f2- \| rev \| uniq \| grep -v "image"~~); do~~ chmod 0755 $i~~; done~~</code>	+	<code>[bash,n]
		+	cat /usr/local/maldetect/sess/session.`cat /usr/local/maldetect/sess/session.last` \| grep "{HEX}\\|{MD5}" \| awk '{print $3}' \| rev \| cut -d "/" -f2- \| rev \| uniq \| grep -v "image" \| xargs chmod 0755 $i
		+	</code>