| Linux sh00002.bigrock.com 5.14.0-687.29.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 23 16:18:48 EDT 2026 x86_64 Path : /scripts/ |
| Current File : //scripts/hackcheck |
#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/hackcheck Copyright 2022 cPanel, L.L.C.
# All rights reserved.
# copyright@cpanel.net http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited
use Cpanel::Rand ();
use Cpanel::FileUtils::TouchFile ();
use Cpanel::SafeDir::MK ();
$| = 1;
my $tmpdir = Cpanel::Rand::gettmpdir(); # audit case 46806 ok
my $is_hacked = '';
if ( -d $tmpdir ) {
foreach my $num ( 0 .. 9 ) {
Cpanel::FileUtils::TouchFile::touchfile("$tmpdir/$num");
if ( !-f "$tmpdir/$num" ) {
$is_hacked = "Could not create file $tmpdir/$num: $!";
last;
}
elsif ( !unlink("$tmpdir/$num") ) {
$is_hacked = "Could not remove file $tmpdir/$num: $!";
last;
}
Cpanel::SafeDir::MK::safemkdir("$tmpdir/$num");
if ( !-d "$tmpdir/$num" ) {
$is_hacked = "Could not create directory $tmpdir/$num: $!";
last;
}
elsif ( !rmdir("$tmpdir/$num") ) {
$is_hacked = "Could not remove directory $tmpdir/$num: $!";
last;
}
}
if ( !$is_hacked ) {
if ( !rmdir($tmpdir) ) {
$is_hacked = "Could not remove directory $tmpdir: $!";
}
}
}
else { # Can't make random directory in /tmp
$is_hacked = "Failed to create directory $tmpdir: $!";
}
my $msg = <<"EOM";
Attempts to create new directories or files whose filenames begin with numbers have failed.
This is indicative of a root compromise of the server.
The exact error encountered was:
$is_hacked
EOM
if ($is_hacked) {
print "[hackcheck] Possible rootkit detected\n$msg";
require Cpanel::Notify;
Cpanel::Notify::notification_class(
'class' => 'Check::Hack',
'application' => 'Check::Hack',
'constructor_args' => [
'origin' => 'hackcheck',
'reason' => $is_hacked
]
);
}
exit if -e '/etc/disablehackcheck';
foreach my $account (qw(xfs daemon)) {
my @pwnam = getpwnam($account);
next if !$pwnam[0];
if ( $pwnam[1] !~ m{^[\!\*]} ) {
system( "/usr/bin/passwd", "-l", $account );
}
}
my ( $user, $uid );
open( my $passwd, '<', "/etc/passwd" );
while (<$passwd>) {
next if (m/^\#/);
( $user, undef, $uid, undef ) = split( /:/, $_, 3 );
next if ( !defined $uid );
if ( $uid == 0 && $user ne "root" && $user ne "toor" ) {
system( '/usr/bin/passwd', '-l', $user );
print "[hackcheck] $user has a uid 0 account (root access).\n";
require Cpanel::Notify;
Cpanel::Notify::notification_class(
'class' => 'Check::Hack',
'application' => 'Check::Hack',
'constructor_args' => [
'origin' => 'hackcheck',
'suspicious_user' => $user
]
);
}
}
close($passwd);