8

What do these regex commands mean? I found them when I ran the history command:

grep --include=\*.php -rnw . -e "update.creditcard"
grep --include=\*.php -rnw . -e "e41e"
grep --include=\*.php -rnw . -e "nobugs.com"
grep --include=\*.{php|js} -rnw . -e "nobugs.com"
grep --include=\*.[php|js] -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"
grep --include=\*.js -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"

I noticed that my website had quite a lot of pages missing, so I went to the server and I found those commands using history. However, I don't have any idea what they do.

Only myself and one other person have admin access to the server, and neither of us recognise these commands.

  • 1
    Welcome to this website. If you need to understand those commands as you say then just type on Terminal man grep because this website is for securty questions only, if you want to know why you lost your pages then your question does not provide anything related to that. – user45139 Jul 27 '15 at 10:49
  • 2
    @OldCastle In that case it sounds like you have been compromised. – kasperd Jul 27 '15 at 11:21
  • 3
    The commands after those greps will be the scary ones I'd imagine: those are just commands looking for scripts that refer to those sites. You probably want to look see what was changed in the files that the last grep finds, if any: check for any recently modified ones, check for edit commands immediately following the above greps. – Dewi Morgan Jul 27 '15 at 12:11
19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings.

However, if your shell history has unexplainable entries, that's a sign that you've been hacked.

At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your server - probably by reinstalling the OS, restoring your content from a back-up, and then plugging whatever hole led to the compromise in the first place (if you can identify it).

Checking SSH logs

On CentOS, SSH logs are written to /var/log/secure by default. On Ubuntu, they're written to /var/log/auth.log by default.

Here's a command that will search either of those locations for SSH log entries:

grep -i 'ssh' /var/log/secure /var/log/auth.log

You'll probably be interested in the most recent log entries, which will be at the end of that command's output.

Note that it's possible that there are no entries in the logs indicating a break-in; this could be because the attacker wiped SSH logs, but didn't wipe shell history.

Some commands that will be useful for log investigation are grep, tail, and less. Also remember that you can pipe output from one command into another. Check the manpages or the Unix & Linux Stack Exchange if you need more help with command line tools like those.

16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.)

And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server.

The searches themselves are harmless. But if anybody unauthorized had access then there is no telling what else he/she might have done.

  • It is possible for me to know when those command ran on the sever? – OldCastle Jul 27 '15 at 11:04
  • 3
    One option would be to use the "last" command to see who has been logged in, when. Then, by looking at the logs, you can see how many times the word "exit" appears after that user logged off, and get an approximate idea of which one (only approximate since not all sessions end with an exit). – Dewi Morgan Jul 27 '15 at 12:06
  • 4
    @OldCastle In this case, I don't think you should be worrying about that anymore. Worry about the nuke & pave operation. – Riking Jul 27 '15 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.