Do these regex show that I was hacked?

Question

What do these regex commands mean? I found them when I ran the history command:

grep --include=\*.php -rnw . -e "update.creditcard"
grep --include=\*.php -rnw . -e "e41e"
grep --include=\*.php -rnw . -e "nobugs.com"
grep --include=\*.{php|js} -rnw . -e "nobugs.com"
grep --include=\*.[php|js] -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"
grep --include=\*.js -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"

I noticed that my website had quite a lot of pages missing, so I went to the server and I found those commands using history. However, I don't have any idea what they do.

Only myself and one other person have admin access to the server, and neither of us recognise these commands.

Answer 1

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings.

However, if your shell history has unexplainable entries, that's a sign that you've been hacked.

At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your server - probably by reinstalling the OS, restoring your content from a back-up, and then plugging whatever hole led to the compromise in the first place (if you can identify it).

Checking SSH logs

On CentOS, SSH logs are written to /var/log/secure by default. On Ubuntu, they're written to /var/log/auth.log by default.

Here's a command that will search either of those locations for SSH log entries:

grep -i 'ssh' /var/log/secure /var/log/auth.log

You'll probably be interested in the most recent log entries, which will be at the end of that command's output.

Note that it's possible that there are no entries in the logs indicating a break-in; this could be because the attacker wiped SSH logs, but didn't wipe shell history.

Some commands that will be useful for log investigation are grep, tail, and less. Also remember that you can pipe output from one command into another. Check the manpages or the Unix & Linux Stack Exchange if you need more help with command line tools like those.

Answer 2

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.)

And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server.

The searches themselves are harmless. But if anybody unauthorized had access then there is no telling what else he/she might have done.