Skip to content

Instantly share code, notes, and snippets.

@duongkai

duongkai/compromised_debian.md

Created November 1, 2022 06:50
Show Gist options
  • Save duongkai/0f532abfa90ba5e58a60f98ca1b08f9c to your computer and use it in GitHub Desktop.
Save duongkai/0f532abfa90ba5e58a60f98ca1b08f9c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. duongkai created this gist Nov 1, 2022.
    15 changes: 15 additions & 0 deletions compromised_debian.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    One server has been compromised. The Incident Response team has acquired its image for further forensics.
    So, your task is reviewing this server image and develop a investigation report to answer what hacker had done on this server.

    Image download link: https://drive.google.com/file/d/1DAJ0F8IbaTQQ_pqG73mE1qsJ5-ng0DCi/view?usp=sharing
    Access credential:
    - rc3user:toor
    - root:toor

    When review a Linux server, an investigator often reviews these places
    - bashrc
    - crontabs
    - profiles
    - init.d files
    - inittab
    - files being replace by checking which <command> or alias commmand