Current Path : /opt/zabbix_scripts/

Upload File :

Current File : //opt/zabbix_scripts/check_slash_tmp_elf_proc

#!/bin/bash
#########################################################################
#                                                                       #
# Plugin name:  check_slash_tmp_php_proc                                #
# Description:  Plugin to check for rogue processes either running      #
#               in /tmp, executed with "./", or with a masked name.     #
# Author:       William Overko                                          #
# Version:      20191030                                                #
#                                                                       #
#########################################################################


procUsers=`ps auwx | grep -vE '^(root|mailman)' | grep -E '([0-9]{1,4}:[0-9]{1,2}\ (\.\/|\/tmp|\/var\/tmp|perl \/tmp|(sh\ \-c){0,1}\ \.\/[a-zA-Z0-9]*|(bash|proc)|\[stealth\]|memc|pwr|ramf|sed|xen))|(perl \/var\/tmp)|\ python' | awk '{print $1}' | sort | uniq`
procCount=`ps auwx | grep -vE '^(root|mailman)' | grep -E '([0-9]{1,4}:[0-9]{1,2}\ (\.\/|\/tmp|\/var\/tmp|perl \/tmp|(sh\ \-c){0,1}\ \.\/[a-zA-Z0-9]*|(bash|proc)|\[stealth\]|memc|pwr|ramf|sed|xen))|(perl \/var\/tmp)|\ python' | awk '{print $1}' | sort | uniq | wc -l`


if [ ${procCount} -eq 0 ]
then
    echo -e "OK: No processes found."
    exit 0
elif [ ${procCount} -gt 0 ]
then
    declare userOutput='Processes running under the following usernames: '
    for user in "${procUsers[@]}"
    do
        user=`getent passwd $user | cut -d: -f1`
        userOutput="$userOutput $user"
    done
    echo -e "CRITICAL: $userOutput."
    exit 2
fi

Copyright 2K16 - 2K18 Indonesian Hacker Rulez