Re: Strange Attack On A Webserver I Work On

From: Jason Stewart (jstewart_at_rtl.org)
Date: 10/27/04

  • Next message: Reimundo Heluani: "Re: Strange Attack On A Webserver I Work On" 
    Date: Wed, 27 Oct 2004 09:00:21 -0400
To: focus-linux@securityfocus.com

    On 26/10/04 20:30 -0400, Matthew J. Sahagian wrote:
    > Hello, I'm a long time reader of this list and have never really had the need to post here. However, recently a webserver that I do minimal administrative work for was attacked. We're still unsure exactly what had been done. Most of the logs have been either cleaned or wiped completely (either by log rotate or by the attacker). I was gone for the weekend so I sorta came back to this. I don't really have questions about the attack per se, we're doing pretty well at the recovery process.... one question I do have however is this.

    Sometimes script kiddies will forget to erase their shell history
    files. You can locate them with the following find regex:

    find / -regex '.*\(\/\.bash_history$\|\/\.history$\).*' -xdev

    Good Luck,
    Jason

  • Next message: Reimundo Heluani: "Re: Strange Attack On A Webserver I Work On"