Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Long time ago, my server was brute forced and a root kit was installed on.

Since then, I have bunch of root kit checkers and Im always changing my password. However, without fully understanding how the kits work, its a little hard to feel safe.

Can anyone point me to where I can download a rootkit and deploy it on my own system. I live in the US. So I know that I can not use it on anyone other than my self. I promise to use it on a closed network. If someone can just provide a link to where I can download the file.

PS: I don't know if it matter. But I want the rootkit to run on *inx machines. Which also brings up another question? will it work on a mac as well?

share|improve this question

migrated from stackoverflow.com Jul 13 '11 at 16:57

This question came from our site for professional and enthusiast programmers.

closed as off topic by Zoredache, John Gardeniers, Tom O'Connor, RobM, EEAA Jul 15 '11 at 16:11

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Look in packetstormsecurity.org. –  SIFE Jul 13 '11 at 16:06
2  
Once you know how rootkits and rootkit checkers work, you're guaranteed to never feel safe. –  Alex Holst Jul 13 '11 at 17:09

4 Answers 4

This post can be pretty informative.

However, without fully understanding how the kits work, its a little hard to feel safe.

Rootkits usually share common characteristics, but no two are the same. One thing they should all require (if your box is configured properly) is root access. If you want to feel safe, you should make it as hard as possible to access root on your system.

The first step is to ensure you keep all software up to date.

share|improve this answer

If you're looking for live malware (including rootkits) take a look at Offensive Computing

share|improve this answer

'rkhunter' is a pretty nice Anit-Rootkit solution for *nix platforms and several features including update-itself feature and a cronjob mode to run it as a daemon.

Link: http://www.rootkit.nl/projects/rootkit_hunter.html

could bea easily installed as #yum install rkhunter

for Mac, you have OSX Rootkit Hunter

Link: http://www.antirootkit.com/software/OS-X-Rootkit-Hunter.htm

there is more list for Anti-Rootkit Solutions on different platforms @ Link: http://www.antirootkit.com/software/index.htm

share|improve this answer

Slightly related: penetration testing / security auditing intended BackTrack Linux can be a great learning environment, too.

Also Damn Vulnerable Linux (which ships the most vulnerable versions of programs) is cool, although the new major version is in progress. Maybe.

share|improve this answer