Shell history the attacker turned off

The intruder unset HISTFILE, so .bash_history is empty. Recover the commands from memory with linux.bash and match them to a running process with linux.pslist.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

A web server’s .bash_history files show nothing unusual, but the host was beaconing at midnight. The responder captured RAM with AVML before rebooting: cases/web-3/web-3.lime.

linux.bash reads command history straight from each bash process’s memory, so unsetting HISTFILE only stops it reaching disk. linux.pslist gives PID, PPID, and UID.

analyst@forensics-ws

forensics-ws · Memory forensics

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@forensics-ws:~/cases/web-3$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.