Server Hacked

I got my server hacked.

Usefull Linux Commands:

Find a file on a server:
Examples

find -name 'mypage.htm'

In the above command the system would search for any file named mypage.htm in the current directory and any subdirectory.

find / -name 'mypage.htm'

In the above example the system would search for any file named mypage.htm on the root and all subdirectories from the root.

find -name 'file*'

In the above example the system would search for any file beginning with file in the current directory and any subdirectory.

find -name '*' -size +1000k

In the above example the system would search for any file that is larger then 1000k.

Check to see what SSH commands was used on your server:

/root/.bash_history

=============================


How to extract the IP's from Linux logs.

============

#!/usr/bin/php

if ($argc == 2 && file_exists($argv[1])) {

$file = file_get_contents($argv[1]);
$regex = '/([\d]{1,3}\.){3}[\d]{1,3}/';

$matches = array();
$num = preg_match_all($regex, $file, $matches);

fwrite(STDOUT, "Found " . $num . " matches:\n");

foreach($matches[0] as $match) {
fwrite(STDOUT, $match . "\n");
}
} else {
fwrite(STDOUT, "Please supply a file to process.\n");
}

exit(0);
?>

Save as 'find_ips.php', and run from the containing folder:

php find_ips.php /absolute/path/to/text/file

Typing in 'php find_ips ' and then dragging the text file to the Terminal window works great. You can pipe the results into another textfile:

php find_ips.php /absolute/path/to/text/file > output.txt

====================



http://www.k6.ro/output.0.txt