Shell History

Investigate a Linux user's home directory and find every way an attacker kept access.

Scenario

A Larkspur Logistics deploy server started acting up after hours. Before wiping and rebuilding it, the responders tarred up the deploy user's home directory. The intruder had run history -c on the way out to tidy up after themselves, not realising the snapshot was already on its way to the analysts.

Go through the handful of files attackers usually touch on a Linux box and work out how they got in, what they left running, and how they planned to get back in later.