Detecting and Checking Rootkits with Chkrootkit and rkhunter Tool in Kali Linux

In this article, we are going to see how to Detect and Check Rootkits with Chkrootkit and rkhunter in Kali Linux.

Method 1: Using chkrootkit

chkrootkit: It is a free and open-source antivirus tool available on GitHub. This tool checks locally in the binary system of your machine and scans your Linux server for a trojan. chkrootkit is a shell script which checks system binaries for rootkit modification.  This tool is used for scanning botnets, rootkits, malware, etc. This tool is completely tested on  Linux 2.0.x, 2.2.x, 2.4.x, 2.6.x, and 3.x.x, FreeBSD 2.2.x, 3.x, 4.x, 5.x and 7.x, OpenBSD 2.x, 3.x and 4.x., NetBSD 1.6.x, Solaris 2.5.1, 2.6, 8.0 and 9.0, HP-UX 11, Tru64, BSDI and Mac OS X. This tool comes under General Public License (GPL). 

Installation:

Step 1: Open your kali Linux operating system and use the following command to install the tool.

git clone https://github.com/Magentron/chkrootkit.git
cd chkrootkit
ls

Step 2: Now use the following command to run the tool.

./chkrootkit

The tool has started checking whether the files are infected or not. in a similar way, you can also download and scan your local machine for trojans. This tool only works on Linux or Linux distributions.

Method 2: Using Rk-hunter

rkhunter: It (Rootkit Hunter) is a free and open-source Unix-based tool that scans for rootkits. This tool can be used for backdoors and possible local exploits. This tool rkhunter is a shell script which carries out various checks on the local system to try and detect known rootkits and malware. 

Installation:

Step 1: Download and install the tool using the following command.

wget http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz

Step 2: Use the following command to unzip the tool.

tar -xvf rkhunter-1.4.6.tar.gz

Step 3: Use the following command to run the tool.

rkhunter --check

The tool has started checking whether the files are infected or not. Similarly, you can also download and scan your local machine for trojans. This tool only works in Linux or Linux distributions.