find_malicious_symlinks.sh

find_malicious_symlinks.sh

#!/bin/bash
if [ -z "$1" ]; then
        LIST=/tmp/symlink-list.txt
        echo "Looking for links..."
        nice -n 19 ionice -c3 find /home -type l -exec ls -ld {} \; > $LIST
else
        LIST=$1
fi
NFOWNERS=""
NFCNT=0
SUSPCNT=0
TMP=/tmp/$(date +%s)-symlinks.txt
SUSP=/home/nagios/suspicious_links.txt
echo "" > $SUSP; chown nagios: $SUSP
grep -vE "virtfs" $LIST >> $TMP
while read LINK
do
        if [ -n "$LINK" ]; then
        l=$(echo $LINK | awk '{print $9}')
        lslashcheck=$(echo $LINK | awk '{print $11}')
        lf=$(readlink -f  $l 2>/dev/null)
        lo=$(ls -ld $l | awk '{print $3}')
        lfo=$(ls -ld $lf 2>/dev/null | awk '{print $3}')
        lg=$(ls -ld $l | awk '{print $4}')
        lfg=$(ls -ld $lf 2>/dev/null | awk '{print $4}')
        echo "Comparing "$l" and "$lf
        if [ "$lo" != "$lfo" ] && [ -n "$lfo" ]; then
                if [ "$lg" != "$lfg" ] && [ "$lo" != "root" ] && [ "$(echo $lslashcheck | head -c 1)" == "/" ]; then
                        echo $l >> $SUSP
                        SUSPCNT=$((SUSPCNT  + 1))
                fi
        else
                if [ -z "$lfo" ]; then
                        echo "Broken o:"$lfo" "$lf
                        NFCNT=$((NFCNT+1))
                        if [ -z "$(echo $NFOWNERS | grep $lo)" ]; then
                                NFOWNERS=$NFOWNERS" "$lo
                        fi
                else
                        echo $lo"=="$lfo
                fi
        fi
        fi
done < $TMP
echo "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++"
echo "Users with broken links could still be malicious!"
echo "Broken links: "$NFCNT
echo "Users with broken links: "$NFOWNERS
echo "Malicious links: "$SUSPCNT
echo "Malicious links are in "$SUSP