Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It's for an assignment to practice a bit of forensics. We're given VirtualBox images and told to figure out if a certain user messed up the ssh config.

I mounted the image as read-only, and found that the user's .bash_history reads:

rm .bash_history
exit

I'm pretty stuck. Does anyone have any advice?

I'm currently trying (unsuccessfully) to figure out the extcarve tool, and what its output files are.

share|improve this question
    
How hard is the class? Do they expect you to be able to parse raw ext2/3/4 data yet, or are they still at the easy things (like, who is the owner of the sshd config file) ? –  Hennes Apr 4 '13 at 20:20
    
Programs like extcarve and Bulk Extractor were not-too-subtly hinted at... –  Robert Apr 5 '13 at 4:42
add comment

2 Answers

up vote 1 down vote accepted

There might be a simpler way to do this, but this what I would attempt with a physical machine:

  1. Add a second drive.

  2. Boot from an Ubuntu Live CD image (preferably 12.04 LTS).

  3. Open a terminal and install PhotoRec by executing

    sudo apt-get install testdisk
    
  4. Mount the disk you want to recover to.

  5. Start PhotoRec:

    sudo photorec
    
  6. Select the appropriate disk.

  7. Unselect everything except txt in File Opt.

  8. Select the appropriate partition.

  9. Select the appropriate filesystem.

  10. Free should suffice. You can retry with Whole if it doesn't.

  11. Choose a destination for the files on the mounted disk.

  12. Wait for the process to finish.

  13. Search the output with grep:

    grep -R ssh_config /media/<mountpoint>
    

Bash's history file is unlikely to become fragmented, so – unless the file as already been overwritten – this should work.

Keep in mind that somebody that knows what he's doing won't get caught by this. It's easy to prevent command from ever getting saved to the history file by setting HISTCONTROL=ignorespace and prepending the commands with a space or just killing the terminal without exiting properly.

share|improve this answer
    
Good advice. Unfortunately, there was nothing useful containing "ssh_config", only .h and .java files. I'll try searching for that user's name next I guess. Otherwise, I'm a bit stumped. –  Robert Apr 5 '13 at 4:46
add comment

This is one of those times where you are forced to learn a lesson after the fact.

.bash_history is a rather weak way of making sure your users are not being naughty, however, you can secure .bash_history by setting chattr flags.

share|improve this answer
    
You would need to set the append only flag in advance though. And hope the use uses bash as a shell instead of something else. –  Hennes Apr 4 '13 at 20:19
    
Yep, I felt that saying "learn a lesson after the fact" covered that concept. –  jnovack Apr 4 '13 at 20:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.