src/rootcheck/check_rc_trojans.c

   1 /* @(#) $Id: ./src/rootcheck/check_rc_trojans.c, 2011/09/08 dcid Exp $
   2  */
   3
   4 /* Copyright (C) 2009 Trend Micro Inc.
   5  * All right reserved.
   6  *
   7  * This program is a free software; you can redistribute it
   8  * and/or modify it under the terms of the GNU General Public
   9  * License (version 2) as published by the FSF - Free Software
  10  * Foundation
  11  */
  12
  13
  14 #include "shared.h"
  15 #include "rootcheck.h"
  16
  17
  18 /* check_rc_trojans:
  19  * Read the file pointer specified (rootkit_trojans)
  20  * and check if the any trojan entry is on the configured files
  21  */
  22 void check_rc_trojans(char *basedir, FILE *fp)
  23 {
  24     int i = 0, _errors = 0, _total = 0;
  25     char buf[OS_SIZE_1024 +1];
  26     char file_path[OS_SIZE_1024 +1];
  27
  28     char *file;
  29     char *string_to_look;
  30
  31     #ifndef WIN32
  32     char *(all_paths[]) = {"bin","sbin","usr/bin","usr/sbin", NULL};
  33     #else
  34     char *(all_paths[]) = {"C:\\Windows\\", "D:\\Windows\\", NULL};
  35     #endif
  36
  37     debug1("%s: DEBUG: Starting on check_rc_trojans", ARGV0);
  38
  39
  40     while(fgets(buf, OS_SIZE_1024, fp) != NULL)
  41     {
  42         char *nbuf;
  43         char *message = NULL;
  44
  45         i = 0;
  46
  47         /* Removing end of line */
  48         nbuf = strchr(buf, '\n');
  49         if(nbuf)
  50         {
  51             *nbuf = '\0';
  52         }
  53
  54
  55         /* Normalizing line */
  56         nbuf = normalize_string(buf);
  57
  58
  59         if(*nbuf == '\0' || *nbuf == '#')
  60         {
  61             continue;
  62         }
  63
  64
  65         /* File now may be valid */
  66         file = nbuf;
  67
  68         string_to_look = strchr(file, '!');
  69         if(!string_to_look)
  70         {
  71             continue;
  72         }
  73
  74         *string_to_look = '\0';
  75         string_to_look++;
  76
  77         message = strchr(string_to_look, '!');
  78         if(!message)
  79         {
  80             continue;
  81         }
  82         *message = '\0';
  83         message++;
  84
  85         string_to_look = normalize_string(string_to_look);
  86         file = normalize_string(file);
  87         message = normalize_string(message);
  88
  89
  90         if(*file == '\0' || *string_to_look == '\0')
  91         {
  92             continue;
  93         }
  94
  95         _total++;
  96
  97
  98         /* Trying with all possible paths */
  99         while(all_paths[i] != NULL)
 100         {
 101             if(*file != '/')
 102             {
 103                 snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir,
 104                         all_paths[i],
 105                         file);
 106             }
 107             else
 108             {
 109                 strncpy(file_path, file, OS_SIZE_1024);
 110                 file_path[OS_SIZE_1024 -1] = '\0';
 111             }
 112
 113             /* Checking if entry is found */
 114             if(is_file(file_path) && os_string(file_path, string_to_look))
 115             {
 116                 char op_msg[OS_SIZE_1024 +1];
 117                 _errors = 1;
 118
 119                 snprintf(op_msg, OS_SIZE_1024, "Trojaned version of file "
 120                         "'%s' detected. Signature used: '%s' (%s).",
 121                                         file_path,
 122                                         string_to_look,
 123                                         *message == '\0'?
 124                                         "Generic":message);
 125
 126                 notify_rk(ALERT_ROOTKIT_FOUND, op_msg);
 127             }
 128
 129             if(*file == '/')
 130             {
 131                 break;
 132             }
 133             i++;
 134         }
 135         continue;
 136     }
 137
 138
 139     if(_errors == 0)
 140     {
 141         char op_msg[OS_SIZE_1024 +1];
 142         snprintf(op_msg,OS_SIZE_1024, "No binaries with any trojan detected. "
 143                                     "Analyzed %d files.", _total);
 144         notify_rk(ALERT_OK, op_msg);
 145     }
 146 }
 147
 148
 149 /* EOF */