How To Detect Rootkits On Kali Linux - chkrootkit & rkhunter Video Lecture | Get to know Ethical Hacking (English) - Software Development

[Laughter]
hey guys hack exploit here back again
with another video and in this video
we're gonna be looking at how to detect
rootkits on linux and more specifically
in this video are going to be looking at
how to detect rootkits
on kali linux alright so this is a very
very important thing that you know
probably I haven't looked at it and I
doubt anyone else on YouTube has
actually gone through it you know really
well and the reason I'm making this is
because one of you actually sent me a
message on Facebook so thank you for
that and you brought this to my
attention and you know even I had
forgotten about how important this is in
terms of forensics you know when I was
actually going through the certified
ethical hacking course and this was
probably one of the things they skipped
out and when you're talking about
forensics it's something that's not
really looked into especially your own
system forensics and how to you know
many people focus on can Linux and how
to attack and how to attack other
computers but they forget something what
if you're the attacked one and what if
you have a rootkit on your system what
do you do I mean on Windows the the
process is really really simple all you
need to do is just download the latest
antivirus updated update the databases
and it'll Renauld remove all the malware
and or root kits for you or if you're a
bit of an advanced user you can use the
the malwarebytes anti-rootkit program
that is fantastic for detecting you know
and removing root kits even some of the
deepest ones so on Windows you know
these security options are being
tightened up and it would the the large
number of antivirus companies out there
your safety is pretty much I would say
it's it's it's at a good range but with
Linux many people think that especially
with CAD Linux many people think that
they are the ultimate attack without
even remembering that they could be the
target of of an attack and one of the
most common ones on Linux is a rootkit
is a rootkit sorry about that now the
thing is with Linux anti-virus programs
are not in the a typical format and the
easiest way to hide a backdoor is to use
a rootkit alright so let me explain what
a rootkit is
because some of you might not have heard
of a rootkit right so rootkit is
essentially it is a its purpose is to
essentially hide or protect malicious
code or software like a backdoor and
it's process and its purpose is to give
you no root level access to an attacker
and you know for as I said giving root
level access in forms of a back doors
leaving ports open so that the attacker
can connect back and it's and its main
feature of the the most important thing
about this is that it hides itself in
the system files and makes it really
really hard for you to detect it even if
you open up your task manager your
system pros your system processes it's
very very hard to detect alright so by
default Kalyan X already comes with a
rootkit checker I think I'm pretty sure
most of you this is the first time
you've heard of that and one of the one
of the ones that it comes installed with
now back when I was using backtrack you
know about you know five to six years
ago one of the most popular ones was the
chk rootkit or the check rootkit utility
that still is installed to this very day
on Calhoun X it is pre-installed and one
of my other favorite ones which is quite
a quite an advanced one is the arc a
hunter or rootkit hunter which is
awesome so essentially what we're going
to be doing is we're going to be looking
at how to use chk rootkit and RK hunter
all right so chk rootkit is
pre-installed on Cal Linux but if it's
not it's really very simple all you have
to do is just open up your terminal and
just go into your apt-get install chk
root kit so apt-get install chk root kit
all right now since I already have it
installed if I just hit enter it's just
going to update it over over itself all
right so it should complain store with
Cal index and I would recommend that you
update your repositories and your
packages just to make sure you have the
latest version running and that's
because you actually also want to update
the rootkit database for chk rootkit so
that it is able to detect the latest
root kits that are currently out and
obviously being being able to detect the
latest ones is one of the biggest
advantages right so let's get started
with chk rootkit all right so I'm just
going to clear
terminal and one of you actually pointed
out that I should be enlarging my
terminal so I'll do that right now
thank you for the suggestions I really
take them into consideration all right
so let's get started with chk rootkit
not by default if you just run the chk
route get chk rootkit let us actually
use the help menu which is can be
denoted by the the the H command and I
hit enter as you can see the options are
pretty pretty simple you have your help
version the available tests you can
check for the available tasks you can
perform the debug mode you can run it
quietly expert mode I would not
recommend expert mode because that goes
into specifying the the directories that
you want to look in for example the home
directory the the DTC directory etc etc
alright so the simplest way of running
chk rootkit is just by typing it chk-chk
rootkit and once you hit enter it's
going to start the route checking
process and as you can see it's it's
going to start checking all of the
programs are most specifically the
third-party programs all the programs
that come pre-installed so you can see
it's going to go through all the folders
and there we are it's going to give you
the status of whether or not they
infected or their they are not infected
so in this case in my case you can see
that it's going through all the files
and it's going to give you the results
to the right here so as of right now
there we are the process nothing was
detected and if I just scroll all the
way down there we are it is done and
there we go now by default as I said
this is a very very I would say an old
tool in the sense that I've used it
before on on older operating systems
like backtrack but it works great on any
other Linux distribution and that's also
what I wanted to point out if you're
performing forensics on a Linux
distribution that is compromised some
way this is fantastic
you know and I also want to cover
forensics really really well because
many people are just focusing on how to
attack computers they're really not
focusing on their security which i think
is really really important you know you
shouldn't take it for granted just
because you have Kali Linux installed on
your system or any other Linux
distribution installed for that matter
alright so by default you I haven't been
mucking around with my operating system
so I will find I won't expect to find
any rootkit
but if you've been doing you know funny
tests with different types of scripts
scripts that could have a rootkit passed
with with it then you know recommend to
be performing this very very regularly
so that cfk rootkit nothing special one
of my favorite ones as I've said is the
Ark a hunter all right so our key ante
is not pre-installed I actually checked
the repositories to to see what it was
installed as of the latest version of
CAD index and it wasn't installed which
is a pity because I feel it is better
than chk rootkit so let's actually run
that so to install it all you have to do
is just have to get whoops the RK hunter
app get install RK + RK hunter and just
hit install and you see and see I
already have a mine installed so I'm
just going to clear that out and let's
look at the the options that we can run
here now if I just run the RK Hunter
command it'll not run a a test and
that's because we need to use some
options or parameters so if I enter as
you can see there's a lot of options now
by default I'm not going to be going
through all of this because there's more
of very very specific forensics and you
know it deals with encrypting decrypting
and again specifying the files in which
you want to scan the rootkits for so by
default let's look at the usage here now
the commands that we are going to be
using is the C command which will
essentially check the local system for
rootkits you can also look at the
capital C which will check the
configuration files and then we'll exit
alright so by default we'll be looking
at the check and one of the most
important ones that many many people
overlook and they get wrong is the
update right the update command allows
you to check for updates to the database
files now why is this so important this
is essentially why antivirus softwares
update their database they essentially
updating their malware and virus
databases so that they have they can
actually add the other they have a
history of the latest detected rootkit
Santa fire and viruses etc etc so it's
very very important to check for updates
to the database and to update them and
update the database so that you you have
the latest versions and your system or
in this case the utility RK hunter is
able to detect the latest route gets
installed all right so all the root kits
in that
currently on your system so let us run a
simple test here so I'm just gonna hit
RK Honda we are performing a basic check
so RK Honda and C all right the RK
Hunter and C command D small C or
lowercase C and just hit enter and this
will start checking for the rootkits
right so just hit enter and just give it
a few seconds now again this is probably
a more advanced tool for those of you
who are looking for one and you're
moving or you're looking into computer
forensics this is a fantastic tool as
well so as you can see it's gonna start
performing the checks and by default
your status will be will be given here
and the form of okay or again if it's if
there are problems it'll indicate it in
red right so it'll go through all these
system files all your local files and
just give it a few seconds and once it's
done it'll give you a summary a
fantastic summary that you can actually
use in a report if you're performing
forensics on a system now as you can see
by default it's given us a a warning
here and I'll explain what these
warnings are as I said it's going to use
it's its own detection systems to tell
you whether you know whether they could
be a problem it doesn't mean that there
is an actual root kit installed it just
means that there could be something that
you should look at or fix immediately
that could leave your system vulnerable
alright so once that's done it's gonna
hit you - it's gonna ask you to hit
enter so I'm just gonna enter and it's
gonna start checking for rootkits now
and it's gonna check it against the
databases that currently exist so you
can see you have your you have your door
rootkit was that was actually quite a
popular one the Apache warm really
really dangerous there let's see what
some of the other good ones I remember
there was the Bobcat rootkit that was
also something really really interesting
that I looked at some of these are quite
new actually like the the F the f8
rootkit which actually looked at a few
months ago as was actually last last
year you then have the actual one more
thing on to tell you guys just going
through this list of rootkits it's a
great way of learning what fruit kits
you know them some of the most popular
root kits and how to deal with them
alright so once the it's checked against
the most popular root kits as you can
see performing a check of No
get files and directories just hit enter
and I'm gonna do that right now and he's
gonna perform the additional rootkit
checks as I said this is more of an
advanced tool and will give you advanced
features so just let it perform the
additional rootkit checks all right
there we are checking for possible
rootkits rootkit files and directories
nothing found so far it's moving on to
the next step and after it is done it's
gonna give you a very very advanced
summary of the scan that you can use in
your reports so for those of you who are
asking for forensic videos here you are
this is more of an advanced section that
you asked me to cover and yeah this this
is for you so again just let it complete
and I'm just going to let it complete so
there we are we actually have a warning
here which is tell me checking for
suspicious shared memory segments so
that is more of an advanced it's more of
an advanced forensics topic that deals
with memory segments now for those of
you have done the CompTIA a a plus
certification you actually know what
this the shared memory segments means it
actually it's what it means is that
you're sharing your memory your memory
segments if that's for example if you're
using to RAM while you're using to ram
sticks not not a singular one one of
them could be used by another system and
has some of the data still left on it
all right so now it's gonna ask me to
hit enter and I'm gonna it and then it's
gonna check the network is gonna perform
checks on the network so it's gonna
check for open ports very very important
because it said route kids are usually
especially some of the newer rootkits
like on some of the latest Sony hacks
one of the root kits one of the special
one of these special features was that
it allowed it allowed it open actually
opened a few open ports it opened a few
ports that the attacker could connect by
and you know once that happens that's
that so as you can see SSH root access
is allowed on my system yes it is
allowed because I said I'm running this
on a virtual machine and I'm controlling
the environment checking for it and
files and directories I also enabled
that so yeah there we are
just hit enter and it's done so as you
can see it's going to give you a summary
of all the file property checks the
it checks the application checks which
were skipped and you can configure it
through the help menu and the total time
that the check took and all the results
have been written to the log file so in
this log file you can find it under the
the directory viral log and your RK
hunter log so under the log files
alright so that was how to use RK hunter
and CH k route 4 for rootkit detection
on Linux more specifically Kali Linux so
I would really recommend that you check
this out and you know it's a fantastic
tool they're both fantastic tools for
forensics that you can install on any
any Linux distribution and get the most
out of alright so thank you so much for
watching this video if you found value
in this video please leave a like down
below if you have any questions any at
all hit me up in the comment section on
my social networks on kik or on my
website and again I'll be setting up the
discord server I'll probably be making
another video after this explaining the
changes made to the channel and how
you'll be posting your questions and
your video suggestions so without with
that being said I'll be seeing you in
the next video peace
[Music]