Lesson 1.62: Shell history and tool artifacts
Interactive work leaves traces in hidden files: the shell's history, vim's record of files and commands, wget's memory of HTTPS hosts. With the right baseline settings history carries a timestamp for every command and is written after each one, so even an attacker who disables history mid-session leaves the first part behind. In the lab you read root's home directory on the compromised Git server, turn epoch timestamps into times, and confirm each step of the attacker's session from at least two independent artifacts.
18 min
You will learn to
- List the artifact files in a home directory
- Explain HISTTIMEFORMAT and PROMPT_COMMAND='history -a'
- Convert history timestamps with awk strftime and date -d @
- Read vim and wget artifacts
- Corroborate each finding twice
Key terms
- Artifact
- Data a program leaves behind as a side effect, useful as evidence.
- HISTTIMEFORMAT
- When set, bash writes '#EPOCH' before each command in the history file.
- history -a
- Appends the session's new commands to the history file now, not at exit.
- Epoch time
- Seconds since 1970-01-01 00:00 UTC.
- Corroboration
- Confirming a finding from an independent second source.
- Impair history
- unset HISTFILE, HISTSIZE=0, history -c: hiding commands from bash history.
← Tracing a failing program with strace · All lessons · Catching short-lived processes with eBPF →