src/rootcheck/check_rc_trojans.c

   1 /* @(#) $Id$ */
   2
   3 /* Copyright (C) 2009 Trend Micro Inc.
   4  * All right reserved.
   5  *
   6  * This program is a free software; you can redistribute it
   7  * and/or modify it under the terms of the GNU General Public
   8  * License (version 2) as published by the FSF - Free Software
   9  * Foundation
  10  */
  11
  12
  13 #include "shared.h"
  14 #include "rootcheck.h"
  15
  16
  17 /* check_rc_trojans:
  18  * Read the file pointer specified (rootkit_trojans)
  19  * and check if the any trojan entry is on the configured files
  20  */
  21 void check_rc_trojans(char *basedir, FILE *fp)
  22 {
  23     int i = 0, _errors = 0, _total = 0;
  24     char buf[OS_SIZE_1024 +1];
  25     char file_path[OS_SIZE_1024 +1];
  26
  27     char *file;
  28     char *string_to_look;
  29
  30     #ifndef WIN32
  31     char *(all_paths[]) = {"bin","sbin","usr/bin","usr/sbin", NULL};
  32     #else
  33     char *(all_paths[]) = {"C:\\Windows\\", "D:\\Windows\\", NULL};
  34     #endif
  35
  36     debug1("%s: DEBUG: Starting on check_rc_trojans", ARGV0);
  37
  38
  39     while(fgets(buf, OS_SIZE_1024, fp) != NULL)
  40     {
  41         char *nbuf;
  42         char *message = NULL;
  43
  44         i = 0;
  45
  46         /* Removing end of line */
  47         nbuf = strchr(buf, '\n');
  48         if(nbuf)
  49         {
  50             *nbuf = '\0';
  51         }
  52
  53
  54         /* Normalizing line */
  55         nbuf = normalize_string(buf);
  56
  57
  58         if(*nbuf == '\0' || *nbuf == '#')
  59         {
  60             continue;
  61         }
  62
  63
  64         /* File now may be valid */
  65         file = nbuf;
  66
  67         string_to_look = strchr(file, '!');
  68         if(!string_to_look)
  69         {
  70             continue;
  71         }
  72
  73         *string_to_look = '\0';
  74         string_to_look++;
  75
  76         message = strchr(string_to_look, '!');
  77         if(!message)
  78         {
  79             continue;
  80         }
  81         *message = '\0';
  82         message++;
  83
  84         string_to_look = normalize_string(string_to_look);
  85         file = normalize_string(file);
  86         message = normalize_string(message);
  87
  88
  89         if(*file == '\0' || *string_to_look == '\0')
  90         {
  91             continue;
  92         }
  93
  94         _total++;
  95
  96
  97         /* Trying with all possible paths */
  98         while(all_paths[i] != NULL)
  99         {
 100             if(*file != '/')
 101             {
 102                 snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir,
 103                         all_paths[i],
 104                         file);
 105             }
 106             else
 107             {
 108                 strncpy(file_path, file, OS_SIZE_1024);
 109                 file_path[OS_SIZE_1024 -1] = '\0';
 110             }
 111
 112             /* Checking if entry is found */
 113             if(is_file(file_path) && os_string(file_path, string_to_look))
 114             {
 115                 char op_msg[OS_SIZE_1024 +1];
 116                 _errors = 1;
 117
 118                 snprintf(op_msg, OS_SIZE_1024, "Trojaned version of file "
 119                         "'%s' detected. Signature used: '%s' (%s).",
 120                                         file_path,
 121                                         string_to_look,
 122                                         *message == '\0'?
 123                                         "Generic":message);
 124
 125                 notify_rk(ALERT_ROOTKIT_FOUND, op_msg);
 126             }
 127
 128             if(*file == '/')
 129             {
 130                 break;
 131             }
 132             i++;
 133         }
 134         continue;
 135     }
 136
 137
 138     if(_errors == 0)
 139     {
 140         char op_msg[OS_SIZE_1024 +1];
 141         snprintf(op_msg,OS_SIZE_1024, "No binaries with any trojan detected. "
 142                                     "Analyzed %d files.", _total);
 143         notify_rk(ALERT_OK, op_msg);
 144     }
 145 }
 146
 147
 148 /* EOF */