Re: Strange Attack On A Webserver I Work On

On 26/10/04 20:30 -0400, Matthew J. Sahagian wrote:
> Hello, I'm a long time reader of this list and have never really had the need 
> to post here.  However, recently a webserver that I do minimal administrative 
> work for was attacked.  We're still unsure exactly what had been done.  Most 
> of the logs have been either cleaned or wiped completely (either by log 
> rotate or by the attacker).  I was gone for the weekend so I sorta came back 
> to this.  I don't really have questions about the attack per se, we're doing 
> pretty well at the recovery process....  one question I do have however is 
> this.

Sometimes script kiddies will forget to erase their shell history
files. You can locate them with the following find regex:

find / -regex '.*\(\/\.bash_history$\|\/\.history$\).*' -xdev

Good Luck,
Jason