Expert 2: ️ Rootkit Detection - Mendeteksi Rootkit Kernel & User-Level

cd ~ && mkdir forensics-exp2 && cd forensics-exp2

# 1. 5 Tanda Rootkit
echo "=== 5 Tanda Rootkit ==*"
cat << 'ROOTKIT'
1. Proses tidak muncul di ps, tapi ada di /proc
   └── Bandingkan: ps aux vs ls /proc | grep -E '^[0-9]+$'

2. Koneksi jaringan tidak muncul di netstat
   └── Bandingkan: netstat -tlnp vs ss -tlnp

3. File disembunyikan dari ls, tapi terlihat di ls -la /debugfs
   └── Cek dengan debugfs: ls -la /sys/kernel/debug/

4. Driver/module aneh (tidak ada di lsmod tapi ter-load)
   └── Cek /proc/modules vs lsmod output

5. System call table di-hook
   └── Cek /boot/System.map vs memory
ROOTKIT

# 2. Simulasi deteksi
python3 << 'PYEOF'
print("=== Rootkit Detection Scan ==*")
checks = [
    ("Proses hidden check", "FAIL ❌", "ps dan /proc mismatch (PID 1337 di /proc tapi tidak di ps)"),
    ("Module hidden check", "WARN ⚠️", "/proc/modules punya entry tidak ada di lsmod"),
    ("Syscall hook check", "FAIL ❌", "sys_call_table[__NR_write] address tidak match dengan System.map"),
    ("Network hidden check", "PASS ✅", "netstat dan ss konsisten"),
    ("File hidden check", "FAIL ❌", "/etc/shadow ukuran 0 bytes (file sistem disembunyikan)"),
    ("Registry (sim)", "PASS ✅", "Tidak ada autorun mencurigakan"),
]

for check, status, detail in checks:
    print(f"  [{status}] {check}")
    print(f"         {detail}")
    print()

print("Verdict: 🚩 ROOTKIT TERDETEKSI - kemungkinan LKM rootkit level kernel")
print("Action: System suspected compromised - forensic memory capture required")
PYEOF