#!/bin/sh

echo "Checking for idrac vulnarability hack... "

am=0

if [ -f /etc/ld.so.preload ]
  then
    am=$((am+1))
    echo "/etc/ld.so.preload exists, points $am from 3"
fi

if [ -f /lib64/libncom.so.4.0.1 ]
  then
    am=$((am+1))
    echo "/lib64/libncom.so.4.0.1 exists, points $am from 3"
fi

rcl=`cat /etc/rc.local | egrep "pud|minerd" | wc -l`

if [ $rcl -gt 0 ]
  then
    am=$((am+1))
    echo "suspicious lines found in /etc/rc.local points $am from 3"
fi

echo
if [ $am -gt 0 ]
  then
    echo "WARNING. Most probably hacked."
  else
    echo "OK. Server clean. To be safe hide IPMI behind a firewall/VPN."
fi