On a pentest on an internal machine in my companies network that a Linux machine (Debian) had symbolic links in the var/www folder to the /etc/ directory. Further enumeration showed that there was a bash script backing up the /var/www folder but it wasn't a cronjob so it seemed suspicious. Any ideas?


Not enough information to ascertain the likelihood of it being malicious or signs of a breach. It wouldn't be uncommon to find a bash script that is coded to backup a directory but not be regularly invoked. Where was the backup going to? If it is the local system, it probably is just an incomplete sys admin attempt at implementing a backup. If it is backing up to a local file system, then I'd be concerned.

Regarding the links in /var/www/ to files in the etc. directory, sounds like someone did not install apache httpd from the package repo of their distribution, and instead manually installed. Then they probably were perplexed the config files are not in /etc (which is where they would have been located and referenced if installed as a package). So then they moved the files to /etc and put links in place.

It wouldn't be a bad idea to verify the integrity of the httpd install, and make sure it is running an un-tampered version. Probably not malicious but simply signs of an inexperienced sys admin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.