Installing the Command Line Solaris Fingerprint Database Utilities

In this task, you will configure the CLI to the Solaris Fingerprint Database. You will then submit md5 signatures via the sfpC.pl and sidekick.sh scripts.

1)Locate and install the additional Perl Modules needed to complete the exercise. The Perl modules need to be installed in the following order:

	o MIME-Base64-2.12
	o URI-1.17
	o HTML-Parser-3.25
	o Bundle-libnet-1.00
	o Digest-MD5-2.16
	o libwww-perl-5.5397

	# cd /usr/local/pkg/sfp
	# tar xvf perl_module_directory
	# cd perl_module_directory
	# perl Makefile.PL; make; make test; make install

2)Copy the md5 binary to the /bin directory and give it root execute permissions:

	# cd /usr/local/pkg/sfp
	# cp md5 /bin
	# chmod 500 /bin/md5

3)Generate md5 signatures for the valid netstat binary and the trojan netstat binary and redirect the output to a file called md5.txt

	# cd /usr/local/pkg/sfp
	# md5 ../sun2.rootkit/netstat >> ./md5.out
	# md5 /usr/bin/netstat >> ./md5.out

4)Verify the signatures in the md5.out file.

	# more md5.out
	MD5 (../sun2.rootkit/netstat) = 2f4ec308b282c5c362e9fbd052b961f6
	MD5 (/usr/bin/netstat) = 95c907398946eb99655aca34e081aaa1

5)Submit the md5 signatures to the Solaris Fingerprint Database. Which fingerprint matched?

	# ./sfpC.pl md5.out

2f4ec308b282c5c362e9fbd052b961f6 - (../sun2.rootkit/netstat) - 0 match(es)

Not found in this database.

 95c907398946eb99655aca34e081aaa1 - (/usr/bin/netstat) - 1 match(es)


 canonical-path: /usr/bin/netstat
 package: SUNWcsu
 version: 11.8.0,REV=2000.01.08.18.12
 architecture: sparc
 source: Solaris 8/SPARC
 patch: 109906-06


6)Using the sidekick.sh script, check your host for root kits.

	# ./sidekick.sh -r