brennan revised this gist 1 month ago. Go to revision
1 file changed, 2 insertions, 2 deletions
helpful-commands.sh
| @@ -5,8 +5,8 @@ sudo fsck -n /dev/sdXN # dry-run check, don't fix yet | |||
| 5 | 5 | ||
| 6 | 6 | chroot /mnt/sys /bin/bash # after binding /dev /proc /sys in | |
| 7 | 7 | cat /etc/passwd # any new/unexpected user accounts? | |
| 8 | - | cat /etc/shadow # password hash changed on melo's account? | |
| 9 | - | last -f /var/log/wtmp # login history — any logins melo doesn't recognize? | |
| 8 | + | cat /etc/shadow # password hash changed on admin account? | |
| 9 | + | last -f /var/log/wtmp # login history, any logins melo doesn't recognize? | |
| 10 | 10 | systemctl list-units --state=enabled | less # anything unfamiliar enabled? | |
| 11 | 11 | crontab -l -u root # rogue cron jobs? | |
| 12 | 12 | ls -la /etc/systemd/system/ # anything dropped in that shouldn't be there? | |
brennan revised this gist 1 month ago. Go to revision
1 file changed, 12 insertions
helpful-commands.sh(file created)
| @@ -0,0 +1,12 @@ | |||
| 1 | + | sudo mkdir /mnt/sys | |
| 2 | + | sudo mount -o ro /dev/sdXN /mnt/sys # find the right partition with lsblk first | |
| 3 | + | sudo smartctl -a /dev/sdX # look for reallocated sectors, pending sectors, offline uncorrectable | |
| 4 | + | sudo fsck -n /dev/sdXN # dry-run check, don't fix yet | |
| 5 | + | ||
| 6 | + | chroot /mnt/sys /bin/bash # after binding /dev /proc /sys in | |
| 7 | + | cat /etc/passwd # any new/unexpected user accounts? | |
| 8 | + | cat /etc/shadow # password hash changed on melo's account? | |
| 9 | + | last -f /var/log/wtmp # login history — any logins melo doesn't recognize? | |
| 10 | + | systemctl list-units --state=enabled | less # anything unfamiliar enabled? | |
| 11 | + | crontab -l -u root # rogue cron jobs? | |
| 12 | + | ls -la /etc/systemd/system/ # anything dropped in that shouldn't be there? | |
Newer
Older