Lesson 2.66: Recovering shell history from memory
Attackers turn off history: unset HISTFILE, HISTFILE=/dev/null, history -c. That stops bash from writing ~/.bash_history, but bash still keeps every command in its own memory while the shell is open. Volatility's linux.bash plugin finds that list in each bash process in the image, with the time each command was typed. In the lab the history file on db02 is innocent; memory isn't. You recover the attacker's session, find which shell it was, and turn it into a timeline that shows a full database export.
16 min
You will learn to
- Explain why disabling history doesn't clear memory
- Recover commands with linux.bash
- Tie commands to a shell and its parent
- Build a timeline from tab-separated output
- Spot data theft in recovered commands
Key terms
- linux.bash
- Volatility plugin that recovers history entries from bash processes in memory, with timestamps.
- HISTFILE
- Where bash saves history at exit; /dev/null or unset means nothing is saved.
- history -c
- Clears the shell's visible history list; doesn't wipe memory.
- Timeline
- Events from different sources ordered by time.
- pg_dumpall
- Dumps every database of a PostgreSQL server.
← Who really did it: attribution through sudo · All lessons · Strings and indicators →