On a pentest on an internal machine in my companies network that a Linux machine (Debian) had symbolic links in the var/www folder to the /etc/ directory. Further enumeration showed that there was a bash script backing up the /var/www folder but it wasn't a cronjob so it seemed suspicious. Any ideas?
1
-
Not enough information to know if someone compromised your machine, also check this one serverfault.com/questions/2783/…, especially take a deep look in log files.– MirsadAug 28, 2017 at 19:03
Add a comment
|
1 Answer
Not enough information to ascertain the likelihood of it being malicious or signs of a breach. It wouldn't be uncommon to find a bash script that is coded to backup a directory but not be regularly invoked. Where was the backup going to? If it is the local system, it probably is just an incomplete sys admin attempt at implementing a backup. If it is backing up to a local file system, then I'd be concerned.
Regarding the links in /var/www/ to files in the etc. directory, sounds like someone did not install apache httpd from the package repo of their distribution, and instead manually installed. Then they probably were perplexed the config files are not in /etc (which is where they would have been located and referenced if installed as a package). So then they moved the files to /etc and put links in place.
It wouldn't be a bad idea to verify the integrity of the httpd install, and make sure it is running an un-tampered version. Probably not malicious but simply signs of an inexperienced sys admin.
