[swank@licious src]$ cat /root/rootkit.sh
#!/bin/bash

NO_ARGS=0

if [ $# -eq $NO_ARGS ] || ! [ -b $1 ] || ! [ -d $2 ]; then
   echo
   echo "This program will compare files on a block device against what is presented to userland."
   echo "This should uncover the vast majority of system files hidden by trojans and rootkits."
   echo "Please also look for ramdisks, directories in /dev/shm, metadata, additional mounts, messed environment variables (path,) and changed file sizes."
   echo
   echo "BUGS: if ls is trojaned but find is not."
   echo
   echo "USAGE: `basename $0` <block device> <search root>"
   echo
   exit
fi;

IFS='
'

DEVICE=$1
ROOT=$2
DIRECTORIES=`find $ROOT -type d`

for DIRECTORY in ${DIRECTORIES[@]}; do

   echo
   echo $DIRECTORY

   FILES_USERSPACE=( $( cd $DIRECTORY; find -xdev -maxdepth 1 -exec basename {} \; | grep -v "^.$" | grep -v "^..$" | grep -v "^$" | sort ) )
   FILES_ON_DISK=( $( debugfs $DEVICE -R "ls -l $DIRECTORY" 2>/dev/null | awk -F: '{ print $2$3$4 }' | cut -b4- | grep -v '^.$' | grep -v '^..$' | grep -v '^$' | sort ) )

   ### DEBUG
   echo "Userspace: ${#FILES_USERSPACE[@]}"
   echo "On Disk:   ${#FILES_ON_DISK[@]}"

   if [ ${#FILES_USERSPACE[@]} -gt ${#FILES_ON_DISK[@]} ]; then
      echo "FILE SYSTEM DAMANGE IN $DIRECTORY?"
      echo "FILES IN USERSPACE"
      echo ${FILES_USERSPACE[@]}
      echo "FILES ON DISK"
      echo ${FILES_ON_DISK[@]}
   else
      USERSPACE_POINTER=0
      ON_DISK_POINTER=0
      while [ $ON_DISK_POINTER -lt `echo "${#FILES_ON_DISK[@]} - 1" | bc` ]; do
         if [ ${FILES_USERSPACE[$USERSPACE_POINTER]} != ${FILES_ON_DISK[$ON_DISK_POINTER]} ]; then
            echo "hidden file: $DIRECTORY/${FILES_ON_DISK[$ON_DISK_POINTER]}"
            ON_DISK_POINTER=`echo "$ON_DISK_POINTER + 1" | bc`
         else
            USERSPACE_POINTER=`echo "$USERSPACE_POINTER + 1" | bc`
            ON_DISK_POINTER=`echo "$ON_DISK_POINTER + 1" | bc`
         fi
      done
   fi
done