CODEWITHSUNDEEP
ubuntu
AaronTheRabbit
AaronTheRabbit

Reputation: 185

How to find specific file when given md5 Hash

Our server has been flagged as being part of a botnet, and we've been given the md5 hash values of the supposedly bad files.

All the examples and suggestions I've read don't quite match what I need. All I'm looking for is how to find this specific file based on the md5 hash we've been given.

Do I need to generate an md5 hash for each file on the computer and then compare it, or is there some easier way to search for this? If not, how would I go about this?

Upvotes: 3

Views: 7773

Answers (1)

pennywise
pennywise

Reputation: 149

You can use find

find /var/www -type f -exec md5sum {} + | grep '^md5sum_given'

Replace /var/www with the directory you want to scan, you can also scan root with /,but this might be very time and resource heavy, depending on your system.

Upvotes: 4

Related Questions