unload-nuk3gh0st

#!/bin/bash

green='\e[0;32m'
red='\e[0;31m'
purple='\e[0;35m'
cyan='\e[0;36m'	
endColor='\e[0m'
item=${green}[*]${endColor}

function print_banner {
	echo ""
	echo -e "${green}###################################${endColor}"
	echo -e "${green}# Unloading nuk3gh0st LKM rootkit #${endColor}"
	echo -e "${green}###################################${endColor}"
	echo ""
}

function enable_selinux {
	echo -e "${item} Reenabling SELINUX"
	echo -e "   ${purple} cmd: setenforce 1${endColor}"
	setenforce 1
        echo ""
}

function disable_selinux {
	echo -e "${item} Disabling SELINUX temporarily"
	echo -e "   ${purple} cmd: setenforce 0${endColor}"
	setenforce 0
	echo ""
}

function unload_rootkit {
	echo -e "${item} Unhiding nuk3gh0st LKM rootkit (making visible with lsmod)"
	echo -e "   ${purple} cmd: nuk3gh0st --unhide${endColor}"
	nuk3gh0st --unhide
	echo ""
	
	echo -e "${item} Unprotecting nuk3ghost LKM rootkit"
	echo -e "   ${purple} cmd: nuk3gh0st --unprotect${endColor}"
	nuk3gh0st --unprotect
	echo ""
	
	echo -e "${item} Unloading nuk3gh0st LKM rootkit"
	echo -e "   ${purple} cmd: rmmod rootkit.ko${endColor}"
	echo -n -e "${cyan}"
	rmmod rootkit.ko
	#sleep 3
	echo -n -e "${endColor}"
	echo ""
}

print_banner
echo -e "${item} Checking if SELINUX is enabled..."
if [ -f /usr/sbin/setenforce ]; then
	echo -e "${item} SELINUX is enabled"
	disable_selinux
	unload_rootkit
	enable_selinux
else
	echo -e "${item} SELINUX is disabled"
	unload_rootkit
fi