##
# Linux Malware Detect v1.6.2
# (C) 2002-2017, R-fx Networks <proj@r-fx.org>
# (C) 2017, Ryan MacDonald <ryan@r-fx.org>
# This program may be freely redistributed under the terms of the GNU GPL v2
##
#
inspath=/usr/local/maldetect
intcnf="$inspath/internals/internals.conf"
libpath="$inspath/internals"
intfunc="$libpath/functions"
logdir="$inspath/logs"
confpath="$inspath"
cnffile="conf.maldet"
cnf="$confpath/$cnffile"
varlibpath="$inspath"
maldet_log="$logdir/event_log"
clamscan_log="$logdir/clamscan_log"
datestamp=`date +"%y%m%d-%H%M"`
utime=`date +"%s"`
user=`whoami`
if [ "$OSTYPE" == "FreeBSD" ]; then
md5sum="/sbin/md5 -q"
else
md5sum=`which md5sum 2> /dev/null`
fi
hostid=`which hostid 2> /dev/null`
if [ "$hostid" ]; then
hostid=`$hostid | $md5sum | awk '{print$1}'`
else
hostid=`uname -a | $md5sum | awk '{print$1}'`
fi
storename_prefix="$hostid.$RANDOM"
od=`which od 2> /dev/null`
find=`which find 2> /dev/null`
perl=`which perl 2> /dev/null`
nice=`which nice 2> /dev/null`
cpulimit=`which cpulimit 2> /dev/null`
ionice=`which ionice 2> /dev/null`
wc=`which wc 2> /dev/null`
mail=`which mail 2> /dev/null`
sendmail=`which sendmail 2> /dev/null`
wget=`which wget 2> /dev/null`
curl=`which curl 2> /dev/null`
pidof=`which pidof 2> /dev/null`
sed=`which sed 2> /dev/null`
stat=`which stat 2> /dev/null`
logger=`which logger 2> /dev/null`
clamscan_extraopts=""
clamdscan_extraopts=""
clamdscan=`which clamdscan 2> /dev/null`
ignore_paths="$confpath/ignore_paths"
ignore_sigs="$confpath/ignore_sigs"
ignore_inotify="$confpath/ignore_inotify"
ignore_file_ext="$confpath/ignore_file_ext"
quardir="$varlibpath/quarantine"
sessdir="$varlibpath/sess"
sigdir="$varlibpath/sigs"
cldir="$varlibpath/clean"
tmpdir="$inspath/tmp"
userbasedir="$varlibpath/pub"
hits_history="$sessdir/hits.hist"
quar_history="$sessdir/quarantine.hist"
clean_history="$sessdir/clean.hist"
suspend_history="$sessdir/suspend.hist"
monitor_scanned_history="$sessdir/monitor.scanned.hist"
sig_version_file="$sigdir/maldet.sigs.ver"
if [ -f "$sig_version_file" ]; then
sig_version=`cat $sig_version_file`
fi
sig_version_url="https://cdn.rfxn.com/downloads/maldet.sigs.ver"
sig_sigpack_url="https://cdn.rfxn.com/downloads/maldet-sigpack.tgz"
sig_clpack_url="https://cdn.rfxn.com/downloads/maldet-cleanv2.tgz"
sig_md5_file="$sigdir/md5v2.dat"
sig_hex_file="$sigdir/hex.dat"
sig_yara_file="$sigdir/rfxn.yara"
sig_cav_hex_file="$sigdir/rfxn.ndb"
sig_cav_md5_file="$sigdir/rfxn.hdb"
sig_cust_md5_file="$sigdir/custom.md5.dat"
sig_cust_hex_file="$sigdir/custom.hex.dat"
lmd_versionsion_file="$inspath/VERSION"
lmd_version="$ver"
lmd_referer="LMD:$ver:$hostid"
lmd_hash_file="$inspath/internals/VERSION.hash"
lmd_hash_url="https://cdn.rfxn.com/downloads/maldet.current.hash"
lmd_version_url="https://cdn.rfxn.com/downloads/maldet.current.ver"
lmd_current_tgzbase_url="https://cdn.rfxn.com/downloads"
lmd_current_tgzfile="maldetect-current.tar.gz"
dig=`which dig 2> /dev/null`
nslookup=`which nslookup 2> /dev/null`
if [ -f "/var/cpanel/mainip" ]; then
remote_ip=`cat /var/cpanel/mainip`
elif [ -f "$dig" ]; then
remote_ip=`$dig +short +time=3 +retry=2 myip.opendns.com @resolver1.opendns.com`
elif [ -f "$nslookup" ]; then
remote_ip=`$nslookup -sil -querytype=A myip.opendns.com resolver1.opendns.com | awk '/^Address: / { print $2 ; exit }'`
fi
remote_uri_timeout="10"
remote_uri_retries="3"
clamav_paths="/usr/local/cpanel/3rdparty/share/clamav/ /var/lib/clamav/ /var/clamav/ /usr/share/clamav/ /usr/local/share/clamav"
tlog="$libpath/tlog"
inotify=`which inotifywait 2> /dev/null`
inotify_log="$inspath/logs/inotify_log"
inotify_user_instances=128
inotify_trim=150000
hex_fifo_path="$varlibpath/internals/hexfifo"
hex_fifo_script="$libpath/hexfifo.pl"
hex_string_script="$libpath/hexstring.pl"
scan_user_access_minuid=30
find_opts="-regextype posix-egrep"
email_template="$libpath/scan.etpl"
email_subj="maldet alert from $(hostname)"
cron_custom_exec="$confpath/cron/custom.cron"
cron_custom_conf="$confpath/cron/conf.maldet.cron"
compatcnf="$libpath/compat.conf"
if [ "$OSTYPE" == "FreeBSD" ]; then
sed="$sed -E"
find_opts=""
fi
Copyright 2K16 - 2K18 Indonesian Hacker Rulez