al0ne / LinuxCheck

Linux应急处置/信息搜集/漏洞检测工具,支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查
MIT License
1.75k stars 380 forks source link

系统文件检查在Ubuntu中运行情况有异常 #17

Open rhchenxm opened 3 months ago

rhchenxm commented 3 months ago

设置保存文件

ipaddress=$(ip address | grep -oP '(?<=inet )\d+.\d+.\d+.\d+(?=\/2)' | head -n 1) filename=$ipaddress''$(hostname)''$(whoami)'_'$(date +%s)_CmdFileCheck_log'.md'

print_msg() { echo -e "$1\n" | tee -a $filename }

print_msg "## 文件检查"

cmdline=( "which" "ifconfig" "ls" "login" "netstat" "top" "ps" "find" "grep" "passwd" "shadow" "curl" "wget" )

获取内核版本信息

kernel_version=$(cat /proc/version)

kernel_version=$(uname -v) print_msg "系统内核版本及编译日期:$kernel_version"

print_msg "### 系统文件修改时间和大小" for cmd in "${cmdline[@]}"; do

使用which获取命令的实际路径

full_path=$(which $cmd) if [ -n "$full_path" ]; then

如果命令存在,获取修改时间并格式化

mod_time=$(stat -c %y "$full_path" | cut -c1-19)
# formatted_time=$(date -d "$mod_time" "+%Y-%m-%d %H:%M:%S")
file_size=$(du -sh "$full_path" | cut -f1)
print_msg "文件:$full_path\t修改日期:$mod_time\t文件大小:$file_size"

else

如果命令不存在,打印消息

print_msg "命令 $cmd 不存在"

fi done

检查是否有file命令,如果有,获取文件类型信息

if command -v file >/dev/null 2>&1; then print_msg "### 系统文件类型" for cmd in "${cmdline[@]}"; do full_path=$(which $cmd) if [ -n "$full_path" ]; then file_type=$(file -b "$full_path") print_msg "文件:$full_path\t\t文件类型:$file_type" else print_msg "命令 $cmd 不存在" fi done else print_msg "系统无file命令,未检查系统文件类型。" fi