Hello,
I posted a work-around for this on stack-exchange, and another
commenter suggested I send it to you folks:
I commented out the code at about line 1241 of the main chkrootkit shell
script, and added replacement code following it:
###if [ `echo abc | head -n 1` = "abc" ]; then
### fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs}
-type f -exec head -n 1 {} \; | $egrep '#!.*php' 2> /dev/null`"
###else
### fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs}
-type f -exec head -1 {} \; | grep '#!.*php' 2> /dev/null`"
###fi
SUFF=`date "+%m%d%H%M%S.%N"`
echo > /tmp/matches.$SUFF
for F in `${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -print`
do
read line <$F
match=`echo "$line" | grep '#!.*php' 2> /dev/null`
if [ -n "$match" ]
then
echo "$F : $match" >> /tmp/matches.$SUFF
fi
done
fileshead=`cat /tmp/matches.$SUFF`
rm -f /tmp/matches.$SUFF
--
Yours,
Kurt Reimer
